EUVD-2026-45431
GHSA-j99f-vprc-xv25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires user interaction, changes scope to victim browser context (S:C), and yields low confidentiality and integrity impact with no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
Online Examination System 1.0 is an open-source PHP web application distributed by code-projects (cpe:2.3:a:code-projects:online_examination_system:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): the application reflects user-supplied values from the eid, n, and t query parameters in the /account.php?q=quiz endpoint directly into HTML output without proper sanitization or output encoding. This failure allows an attacker-controlled string to be interpreted as executable script by the victim's browser. The PHP-based codebase processes these parameters server-side and returns them unescaped, a classic reflected XSS pattern.
RemediationAI
No vendor-released patch has been identified for code-projects Online Examination System 1.0 at time of analysis. As immediate compensating controls, administrators should apply strict input validation and context-aware output encoding (e.g., htmlspecialchars() in PHP) to the eid, n, and t parameters in /account.php before they are reflected into HTML - this eliminates the root cause but requires direct code modification. Deploying a Web Application Firewall with XSS filtering rules (e.g., ModSecurity CRS) can block common payload patterns but introduces false-positive risk and is not a substitute for code-level fixes. Restricting access to the quiz endpoint to authenticated sessions only would raise the bar from PR:N to PR:L, reducing exposure surface. The public PoC is documented at https://github.com/zzzxc643/CVE1/blob/main/project1/vul5.md and should be used to validate any applied mitigations.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today