Which versions of PHP are affected by EUVD-2026-14387?

CVE-2026-4578 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for EUVD-2026-14387?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14387. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14387?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

PHP EUVD-2026-14387

Q: What is the CVSS score of EUVD-2026-14387?

EUVD-2026-14387 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4578 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 VulDB

GHSA-fw33-9hq6-22wp

PHP XSS Exam Form Submission Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 24, 2026 - 16:37 NVD

LOW MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

2.4 (LOW) 4.8 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 07:45 euvd

EUVD-2026-14387

Analysis Generated

Mar 23, 2026 - 07:45 vuln.today

CVE Published

Mar 23, 2026 - 07:36 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.

Technical ContextAI

This is a stored or reflected cross-site scripting vulnerability (CWE-79) in a PHP-based exam management application. The vulnerability exists in the admin update functionality at /admin/update_s3.php where user input via the 'sname' parameter is not properly validated or encoded before being output to the web page. PHP applications are particularly susceptible to XSS when output functions like echo or print are used without proper escaping functions (htmlspecialchars, htmlentities, etc.). The affected product, code-projects Exam Form Submission, is identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*, indicating all versions of this application are potentially vulnerable.

RemediationAI

Contact code-projects to obtain and deploy any available security patches for Exam Form Submission. If patches are unavailable, implement immediate input validation and output encoding by modifying /admin/update_s3.php to use proper PHP escaping functions (htmlspecialchars or htmlentities) on the 'sname' parameter before rendering it in HTML context. As an interim control, restrict administrative access to the /admin/ directory using Web Application Firewall rules or reverse proxy authentication, limit admin access to trusted IP ranges, and implement Content Security Policy (CSP) headers to prevent inline script execution. Enable security logging on the admin panel and monitor for suspicious parameter manipulation attempts. Contact the vendor at https://code-projects.org/ for official patch availability and timeline.