Online Examination System CVE-2026-16220

The vulnerable parameter injection occurs in the /account.php?q=quiz endpoint when any of the eid, n, or t query parameters are supplied with unsanitized script content. No authentication is required (PR:N per CVSS 4.0 vector), meaning the endpoint must be publicly accessible - exploitation is limited if login is required to reach /account.php. Passive user interaction is required (UI:P): a victim must load a crafted URL in their browser, typically via a phishing link or injected href. Exploitation does not require any non-default configuration of the application. Limiting factors include: the victim must be reachable via social engineering, the application must be internet-exposed or accessible to the attacker, and the reflected XSS nature of the flaw means no persistent payload is stored server-side without additional chaining.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N accurately characterizes the constrained impact: no confidentiality or availability damage to the server (VC:N/VA:N), only minor integrity impact (VI:L), and the E:P exploit-maturity modifier confirms public exploit code exists. The mandatory user interaction (UI:P) meaningfully limits mass exploitation - an attacker must socially engineer each victim into clicking a crafted URL. EPSS data was not provided, limiting probabilistic exploitation modeling. The absence from CISA KEV suggests no observed widespread active exploitation. Taken together, this is a genuine but bounded risk: real impact is constrained to session hijacking and UI manipulation against individual users, and the niche academic deployment footprint of this software further limits real-world blast radius.

An attacker identifies a deployment of code-projects Online Examination System 1.0, constructs a URL targeting /account.php?q=quiz with a JavaScript payload injected into the eid, n, or t parameter, and delivers it to a logged-in user via phishing or a malicious link. When the victim loads the URL, their browser executes the injected script, enabling the attacker to steal session cookies, redirect the user, or perform actions on their behalf. A public proof-of-concept demonstrating this exact technique is available at https://github.com/zzzxc643/CVE1/blob/main/project1/vul5.md.