Online Examination System EUVD-2026-72186

No authentication is required - the Feedback Form in feedback.php is accessible to unauthenticated remote users (PR:N, AV:N). Exploitation requires that a victim user (student, administrator, or other) loads or interacts with a page containing the attacker-controlled Name or Subject parameter (UI:P). The vulnerability applies to the default deployment of Online Examination System 1.0 with the Feedback Form component active. Exploitation is limited by the passive victim-interaction requirement: the attacker must either socially engineer a target into visiting a crafted URL (reflected XSS) or store the payload for rendering to subsequent visitors. No specific non-default configuration is required to enable the vulnerable code path.

The CVSS 4.0 score of 5.3 (Medium) reflects the user-interaction requirement (UI:P) and the limited integrity-only impact (VI:L) recorded in the vendor's scoring - however, practical XSS exploitation routinely achieves session token theft that exceeds what the baseline vector captures. With a publicly available proof-of-concept on GitHub and no authentication prerequisite, even a mid-sized municipal IT team in sopot deploying this platform for student examinations should treat this as a moderate-to-high operational priority, particularly given the sensitivity of exam results and account credentials. No EPSS score was supplied in the source intelligence, limiting automated risk-comparison signals. The absence of a CISA KEV entry suggests exploitation has not been observed at scale, but the low barrier to exploitation (public PoC, no privileges, standard web browser as attack surface) means the realistic risk exceeds what the numeric score alone implies. No conflicting signals exist between the description and the CVSS vector.

An attacker identifies a publicly accessible Online Examination System 1.0 instance and submits a crafted payload - such as a script tag within the Name or Subject field of feedback.php - which is stored or reflected in the server's response. When an administrator or student subsequently loads the affected page in their browser, the injected script executes in their session context, allowing the attacker to exfiltrate session cookies or perform actions on behalf of the victim. A working proof-of-concept demonstrating this technique is publicly available on GitHub, lowering the skill threshold required.