Assessment Management CVE-2026-93977

Requires an authenticated lecturer-level account on code-projects Assessment Management 1.0 (PR:L) and the ability to reach lecturer/add-single-mark.php to inject the mark parameter; the payload only executes when a victim's browser renders the affected page (UI:P/UI:R), so it is not a zero-click remote flaw. Limiting factors: valid low-privilege credentials are needed, victim interaction/page rendering is required, and the affected software is a niche academic PHP project rather than a widely deployed platform - all of which sharply constrain real-world exploitability.

This is a low-to-moderate real-world risk despite the 5.1 CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) describes a network-reachable but authenticated (PR:L) cross-site scripting flaw in the lecturer grade-entry interface, with passive user interaction (UI:P) required to fire the payload and only limited integrity impact (VI:L) - consistent with browser-context XSS rather than server compromise. SSVC-style reading: exploitation is Proof-of-Concept (E:P, POC publicly disclosed on GitHub), technical impact is partial, and it is not readily automatable for meaningful gain since it needs a logged-in lecturer account and a victim rendering the malicious mark. No EPSS score and no CISA KEV entry are provided; there is no evidence of active exploitation, so the POC signal should not be conflated with in-the-wild use. The only intelligence sources are VulDB (407936) and a single GitHub POC - no independent NVD analysis or vendor advisory beyond the code-projects homepage. Net: a genuine but low-priority XSS in a hobbyist PHP application, not an urgent-patch situation for most environments.

An authenticated lecturer (or an attacker who has obtained lecturer credentials) submits a mark value containing a JavaScript payload via lecturer/add-single-mark.php; the unsanitized mark is later rendered in the application, executing script in the browser of whoever views it (e.g., another staff user or the same user). A public proof-of-concept exists on GitHub (zzzxc643/CVE1, 2026-8-24/vul5.md), lowering the effort to reproduce, though exploitation still requires a valid low-privilege session and victim page rendering (UI:P).