Which versions of PHP are affected by CVE-2026-4972?

Organizations using code-projects Online Reviewer System should be aware of moderate risk from CVE-2026-4972, a cross-site scripting vulnerability rated CVSS 4.8.

Is there a public PoC exploit available for CVE-2026-4972?

Yes, a public proof-of-concept exploit is available for CVE-2026-4972. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4972?

Within 30 days: Identify affected systems running code-projects Online Reviewer System and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4972

Q: What is the CVSS score of CVE-2026-4972?

CVE-2026-4972 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16805 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 VulDB

PHP XSS Online Reviewer System Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 19:30 euvd

EUVD-2026-16805

Analysis Generated

Mar 27, 2026 - 19:30 vuln.today

CVE Published

Mar 27, 2026 - 19:15 nvd

MEDIUM 4.8

DescriptionCVE.org

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Online Reviewer System up to version 1.0 allows authenticated users with high privileges to inject malicious scripts via the Description parameter in /system/system/students/assessments/databank/btn_functions.php, which are then executed in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and has publicly available exploit code, but poses minimal real-world risk given the high privilege requirement (PR:H) and low impact severity (CVSS 2.4).

Technical ContextAI

The vulnerability exists in a PHP-based learning management system where user-supplied input from the Description parameter is not properly sanitized or encoded before being stored in a database and subsequently rendered in HTML responses. This is a classic stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the Online Reviewer System's assessment databank functionality. The cpe:2.3:a:code-projects:online_reviewer_system:*:*:*:*:*:*:*:* designation indicates all versions up to and including 1.0 are vulnerable. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation requires no special conditions beyond network access, but the PR:H (high privilege) requirement means only administrators or high-privileged account holders can inject the payload.

RemediationAI

Upgrade to a version of code-projects Online Reviewer System newer than 1.0 if available; no specific patched version number is confirmed in the available data. The primary remediation is input validation and output encoding: ensure all user-supplied input to the Description parameter is validated against a whitelist of acceptable characters and HTML-encoded (or properly escaped) before storage and display. Implement content security policy (CSP) headers to mitigate stored XSS impact. As a temporary workaround pending an upgrade, restrict access to the assessment databank to trusted administrators only and review audit logs for suspicious Description entries. For detailed vulnerability information and any vendor patches, consult https://vuldb.com/?id.353859 and the code-projects project repository.