EUVD-2026-14367
GHSA-cp6c-hh2v-v765
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s2.php. This manipulation of the argument sname causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
AnalysisAI
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s2.php endpoint where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the browser of other users who view the affected page, potentially leading to session hijacking, credential theft, or administrative action manipulation. A public proof-of-concept exploit is available on GitHub, and the vulnerability carries a low CVSS score of 2.4 due to requiring high privileges and user interaction, but the published exploit status indicates active reconnaissance and potential targeted exploitation.
Technical ContextAI
This vulnerability is rooted in improper input validation and output encoding in a PHP-based web application, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation or Cross-Site Scripting). The affected product, code-projects Exam Form Submission (identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), processes user-supplied input from the 'sname' parameter in the administrative interface (/admin/update_s2.php) without adequate HTML entity encoding or Content Security Policy protections. The PHP framework fails to escape or validate the parameter before reflecting or storing it in the DOM, allowing attackers to break out of HTML attributes or tag context and inject arbitrary script tags or event handlers that execute in victim browsers.
RemediationAI
Upgrade code-projects Exam Form Submission to the latest patched version available from the vendor (https://code-projects.org/). If a patch is not immediately available, implement the following compensating controls: restrict administrative access to /admin/update_s2.php to specific IP ranges or require VPN authentication, enable a Web Application Firewall (WAF) with rules to detect and block XSS payloads in the 'sname' parameter (e.g., filtering script tags and event handlers), and enforce HTTP-only and Secure flags on session cookies to prevent JavaScript-based session theft. Additionally, implement a Content Security Policy (CSP) header to restrict inline script execution and external script sources, reducing XSS impact even if injection succeeds. Review administrative user accounts for unauthorized modifications to exam records and monitor access logs for suspicious activity patterns.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today