EUVD-2026-83718
GHSA-m5g2-9cpc-xgm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to admin panel (PR:H)
-
DeliverySubmit edit-user.php with script in name/id field
-
ExploitPayload stored/reflected unencoded
-
ExecutionAdmin views user record (UI)
-
ImpactScript executes in admin browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the administrative User-Editing interface (admin/edit-user.php) of code-projects Assessment Management 1.0 - consistent with the vendor's PR:H. Exploitation also requires victim interaction (UI:P/UI:R): a user must view the record containing the injected payload for the script to fire. Limiting factors: the attacker must already hold admin-panel access, which sharply reduces added privilege gained, and no bypass to reach edit-user.php without authentication is described. No non-default configuration is required beyond a running instance of the application. |
| Impact | This is a low-priority, high-noise issue rather than a genuine emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N, score 4.8, E:P) is internally coherent for a stored/reflected XSS reachable only from the admin User-Editing panel: network reachable but gated behind high privileges (PR:H) and requiring victim interaction (UI:P), with only limited integrity impact (VI:L). No EPSS score, no CISA KEV listing, and no SSVC automation data are provided; the only positive exploitation signal is publicly available POC code (github.com/zzzxc643/CVE1). POC availability is NOT active exploitation - no in-the-wild evidence exists. The key tension is the PR:H requirement: because admin/edit-user.php is an administrative function, an attacker who can reach it already holds admin rights, so the practical value of injecting script is marginal (self-XSS or cross-admin script at best). I dispute the vendor's VC:N - reflected/stored XSS typically permits session-cookie or token theft, so confidentiality should be VC:L rather than N. Net: real-world risk is low, driven more by the CVE-mill reporting pattern (VulDB-sourced, hobbyist PHP app) than by exploitability. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has already obtained admin access) submits the edit-user form in admin/edit-user.php with a JavaScript payload in the name, sname, email, username, password, or id field. The payload is stored/reflected without proper encoding and executes in the browser of an admin who views the affected user record. Public POC code exists demonstrating the injection, though no active exploitation has been observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Stored cross-site scripting in code-projects Assessment Management 1.0 allows an authenticated administrator to inject arbitrary script through the user-editing form at admin/edit-user.php, where the name, sname, email, username, password, and id parameters are written into the database or rendered without proper output encoding. The payload executes in the browser of any user who later views the manipulated record, so exploitation requires both prior access to the admin interface (PR:H) and victim interaction (UI:P/UI:R), which caps the incremental privilege gained by the attacker. Publicly available exploit code exists and has been disclosed via a GitHub proof-of-concept, but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS score was supplied; the disclosed CVSS 4.0 base score is 4.8, and this is best treated as a low-priority, high-noise hardening issue rather than an emergency.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version number is available in the supplied intelligence - the references point only to the VulDB entry and a public proof-of-concept, so the exact remediation state should be confirmed with code-projects.org before assuming a fix exists. Because exploit code is publicly available and the vulnerable page is administrative, the most effective compensating control is to restrict and monitor access to the admin interface: place /admin/ behind network allow-listing, VPN, or HTTP authentication so that only trusted operators can reach edit-user.php, accepting the trade-off that legitimate administrative workflows must originate from approved networks or hosts. Where control over the deployment exists, add server-side input validation and context-aware output encoding for the name, sname, email, username, password, and id parameters (rejecting or entity-encoding HTML metacharacters on input and when echoing into HTML, attribute, or JavaScript contexts), noting that this requires source modification of a project that may be unmaintained. Deploy a WAF rule that blocks script-bearing payloads and suspicious markup in POSTs to edit-user.php as a stopgap, understanding that WAF signatures are bypassable and create false-positive risk for legitimate administrative edits. Enable a restrictive Content-Security-Policy (e.g. disallowing inline script) and set session cookies HttpOnly so that any residual XSS cannot trivially exfiltrate session tokens, while recognizing CSP will not stop stored payloads that inject markup into legitimate fields. Finally, rotate credentials and review audit logs for unexpected changes to user records, since the vulnerable endpoint also handles the password and username fields. Monitor https://vuldb.com/vuln/407934 and https://code-projects.org/ for an official fix before relying on any single mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application, code-projects Assessment Management 1.0, distributed through code-projects.org as a learning/portfolio-style project. The vulnerable code path is admin/edit-user.php, the administrative User Editing handler; user-supplied values for the name, sname, email, username, password, and id parameters are accepted and persisted or echoed without adequate sanitization or context-aware output encoding. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting), typically manifested here as stored XSS because the injected values are saved to the backing database and rendered on subsequent page views, allowing the script to fire in another user's session. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P describes a network-reachable, low-complexity attack with no special preconditions, but requiring high privileges and passive user interaction, with the only measurable impact being limited integrity change in the vulnerable system; the reported E:P metric reflects the publicly circulating proof-of-concept. The independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) agrees on the authenticated prerequisite and user-interaction requirement, differing mainly in that it scores the scope change and low confidentiality/integrity impact expected when script executes in a higher-privileged or administrative browsing context.
Know when Assessment Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Admin-only edit-user.php means PR:H; XSS needs a victim to view the record (UI:R) and crosses into the victim's browser context (S:C) with session-theft confidentiality (C:L) and DOM tampering (I:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Assessment Management
View allSQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, mo
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via
Cross-site scripting in code-projects Assessment Management 1.0 allows remote unauthenticated attackers to inject malici
SQL injection in code-projects Assessment Management 1.0 allows authenticated remote attackers to execute arbitrary SQL
SQL injection in code-projects Assessment Management 1.0 exposes database query handling in the lecturer marking-scheme
Stored/reflected cross-site scripting in code-projects Assessment Management 1.0 allows an authenticated lecturer to inj
Cross-site scripting (XSS) in code-projects Assessment Management 1.0 allows a remote attacker with administrative crede
Exploit-DB