Is there a public PoC exploit available for EUVD-2026-41701?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41701. Prioritise patching immediately. EPSS: 0.3%.

Assessment Management EUVD-2026-41701

Q: What is the CVSS score of EUVD-2026-41701?

EUVD-2026-41701 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14657 LOW

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-723w-4265-5w75

PHP SQLi Assessment Management Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQLi requires low-privilege authenticated access; limited C/I/A impact with no scope change aligns with database-confined data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 22:23 vuln.today

Severity Changed

Jul 04, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 22:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in code-projects Assessment Management 1.0. This issue affects some unknown processing of the file /lecturer/marking-scheme.php of the component Database Query Handler. This manipulation of the argument squestions[] causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Assessment Management 1.0 exposes database query handling in the lecturer marking-scheme feature to manipulation via the unsanitized squestions[] parameter at /lecturer/marking-scheme.php. Authenticated remote attackers with low-privilege access can alter SQL query logic to extract or modify student assessment data. A public proof-of-concept exploit is documented on GitHub, lowering the skill bar for exploitation; however, the application is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting its constrained impact and authentication prerequisite.

Technical ContextAI

The affected component is a PHP-based database query handler within the marking scheme module of a PHP academic assessment management application distributed by code-projects.org. CWE-89 (SQL Injection) identifies the root cause: user-supplied input from the squestions[] HTTP parameter array is concatenated directly into a SQL query without sanitization or use of prepared statements. The CPE cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:* uses a wildcard version field, indicating no patched release has been formally designated by NVD or the vendor. The application stack is PHP with a relational database backend (likely MySQL), consistent with code-projects.org's standard project offerings.

RemediationAI

No vendor-released patch has been identified at time of analysis - the wildcard CPE confirms no fixed version is formally designated. Developers with access to source should refactor database interactions in /lecturer/marking-scheme.php to use PHP PDO or MySQLi prepared statements with parameterized queries for the squestions[] input, which eliminates the injection vector at its root. As an immediate compensating control, restrict network access to the application exclusively to trusted institutional IP ranges via web server ACLs or firewall policy, reducing exposure of the lecturer endpoint. Deploying a WAF rule targeting SQL injection payloads in array parameters provides an additional detection and blocking layer, though WAF bypass is possible with sufficiently crafted payloads. The most conservative mitigation is to disable or remove the marking-scheme feature entirely until a code fix is applied. VulDB details are at https://vuldb.com/vuln/376172.