EUVD-2026-14510
GHSA-qvmh-94p6-pp46
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
AnalysisAI
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
Technical ContextAI
This vulnerability is a reflected or stored XSS flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of input validation weakness endemic to PHP web applications. The affected software is code-projects Exam Form Submission (identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), a PHP-based form handling system used for exam management. The vulnerability manifests in the administrative interface file /admin/update_s6.php, where the sname parameter is processed without proper output encoding or input filtering, allowing injection of arbitrary HTML and JavaScript. This is a classic example of inadequate use of PHP's htmlspecialchars(), strip_tags(), or similar sanitization functions during form processing.
RemediationAI
Immediately upgrade code-projects Exam Form Submission to the latest patched version available from https://code-projects.org/. If an immediate patch is unavailable, implement input validation and output encoding by ensuring the sname parameter undergoes sanitization via htmlspecialchars($sname, ENT_QUOTES, 'UTF-8') or equivalent before output, and enforce Content-Security-Policy headers to mitigate XSS impact. Additionally, restrict administrative access to /admin/update_s6.php to specific IP ranges, implement Web Application Firewall (WAF) rules to detect and block script injection payloads in the sname parameter, and enforce strong authentication with multi-factor authentication for all administrative accounts. Monitor application logs for suspicious admin panel activity and consider implementing CSRF tokens on all state-changing form submissions.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today