EUVD-2026-14387
GHSA-fw33-9hq6-22wp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 score of 2.4 appears minimal, the risk assessment reveals important nuances. The CVSS vector shows network accessibility (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), user interaction needed (UI:R), and limited impact (Integrity only, no confidentiality or availability loss). The presence of a publicly disclosed proof-of-concept and the 'E:P' (Exploit Code Maturity: Proof-of-Concept Exists) rating elevate practical risk despite the low score. However, the requirement for high-level administrative privileges (PR:H) and user interaction (UI:R) significantly limits real-world exploitability. This is not a critical vulnerability but rather a low-severity finding that primarily affects admin-to-admin attack scenarios within organizations. Automatable exploitation is limited due to privilege requirements, placing it in a lower-priority remediation bucket from an SSVC perspective. |
| Exploit ScenarioDerived | A malicious administrator with high-level privileges could craft a URL containing JavaScript payload in the 'sname' parameter (e.g., /admin/update_s3.php?sname=<script>alert('xss')</script>) and trick another administrator into clicking it via email or messaging. When the second admin views the page, the injected script executes in their browser session, potentially allowing the attacker to steal session cookies, perform actions on behalf of that admin, or redirect them to a phishing page. A public proof-of-concept is available on GitHub (https://github.com/rockycheng1/cve/issues/2), making this attack pattern straightforward to execute. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.
RemediationAI
Contact code-projects to obtain and deploy any available security patches for Exam Form Submission. If patches are unavailable, implement immediate input validation and output encoding by modifying /admin/update_s3.php to use proper PHP escaping functions (htmlspecialchars or htmlentities) on the 'sname' parameter before rendering it in HTML context. As an interim control, restrict administrative access to the /admin/ directory using Web Application Firewall rules or reverse proxy authentication, limit admin access to trusted IP ranges, and implement Content Security Policy (CSP) headers to prevent inline script execution. Enable security logging on the admin panel and monitor for suspicious parameter manipulation attempts. Contact the vendor at https://code-projects.org/ for official patch availability and timeline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a stored or reflected cross-site scripting vulnerability (CWE-79) in a PHP-based exam management application. The vulnerability exists in the admin update functionality at /admin/update_s3.php where user input via the 'sname' parameter is not properly validated or encoded before being output to the web page. PHP applications are particularly susceptible to XSS when output functions like echo or print are used without proper escaping functions (htmlspecialchars, htmlentities, etc.). The affected product, code-projects Exam Form Submission, is identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*, indicating all versions of this application are potentially vulnerable.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
CVE-2026-4578 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in code-projects Exam Form Submission XSS
View all 2More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB