Assessment Management CVE-2026-93976

Exploitation requires an authenticated administrator session, because the vulnerable endpoint admin/add-user.php is an administrative account-creation function (reflected in PR:H). It further requires user interaction (UI:P) - a privileged user must view the page rendering the injected level value. Limiting factors: the attacker must already possess admin-level access (making it effectively self-XSS or insider/post-compromise use), the impact is confined to script execution in the browser (integrity only, no direct confidentiality or availability loss), and the affected software is a niche code-projects PHP application unlikely to be exposed at scale. It is NOT remotely exploitable by an unauthenticated attacker against a default configuration.

This is a low-real-risk, high-noise finding. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:P/VC:N/VI:L/VA:N, score 1.9) is the most telling signal: exploitation requires HIGH privileges (PR:H) because add-user.php lives under the admin/ path and is an administrator account-creation function, plus passive user interaction (UI:P) and only limited integrity impact (VI:L) with no confidentiality or availability impact. In practice this is close to self-XSS - an authenticated administrator injecting script into a field (level) that they themselves control - so it only becomes meaningful if a stored payload is later rendered to another privileged viewer. SSVC-style reading: technical impact is partial, automatability is low (requires an authenticated admin session and victim interaction), and there is no scope change to another security authority in the vendor scoring. Exploitation status: publicly available exploit code exists (VulDB submission 944589 / vuln 407935 and a public GitHub write-up), but this is NOT active exploitation - no CISA KEV listing and no EPSS score are present in the input, so POC availability must not be conflated with in-the-wild use. There are no conflicting signals here; the low CVSS, the high privilege requirement, and the obscure product all align toward de-prioritization.

An attacker who already holds administrator access to the Assessment Management panel submits admin/add-user.php with a malicious script payload in the level argument; the value is reflected/stored without output encoding and executes in the browser of an admin who later views it. A public proof-of-concept write-up exists (GitHub zzzxc643/CVE1), but because the vector requires PR:H plus victim interaction (UI:P), the realistic scenario is limited to insider misuse or a secondary attacker who has already compromised an admin session.