Is there a public PoC exploit available for CVE-2026-5106?

Yes, a public proof-of-concept exploit is available for CVE-2026-5106. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5106

Q: What is the CVSS score of CVE-2026-5106?

CVE-2026-5106 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17058 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 VulDB

GHSA-jc9w-4gwg-hjf5

PHP XSS Exam Form Submission Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Mar 30, 2026 - 15:39 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 04:45 euvd

EUVD-2026-17058

Analysis Generated

Mar 30, 2026 - 04:45 vuln.today

CVE Published

Mar 30, 2026 - 04:00 nvd

MEDIUM 4.8

DescriptionCVE.org

A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.

Technical ContextAI

The vulnerability is a classic reflected cross-site scripting (CWE-79) flaw in a PHP-based exam management application. The flaw exists in the /admin/update_fst.php endpoint, where user-supplied input from the sname parameter is reflected back to the client without proper sanitization or output encoding. The affected product is the Exam Form Submission plugin/module from code-projects (CPE: cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), which is commonly used to create and manage form-based examinations. The lack of input validation or HTML entity encoding on the sname parameter allows attackers to break out of the intended context and execute arbitrary JavaScript in the victim's browser within the security context of the admin panel.

RemediationAI

The primary remediation is to upgrade from Exam Form Submission 1.0 to a patched version released by code-projects; however, no specific fixed version number is confirmed in available data. As an immediate workaround, apply input validation and output encoding to the sname parameter in /admin/update_fst.php by HTML-encoding all user-supplied values before rendering them in the response, or implement a content security policy (CSP) header to restrict inline script execution. Restrict administrative access to trusted personnel and implement session timeouts for admin accounts. Consult the code-projects advisory (https://code-projects.org/) and VulDB record (https://vuldb.com/vuln/354131) for patch availability and further guidance.