Exam Form Submission
Monthly
Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.
Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.
A Stored or Reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s5.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript code through this parameter, which will execute in the context of other users' browsers when they interact with the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has a low CVSS score of 2.4 due to high privilege requirements and user interaction dependency, but the public disclosure increases practical exploitation likelihood.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s2.php endpoint where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the browser of other users who view the affected page, potentially leading to session hijacking, credential theft, or administrative action manipulation. A public proof-of-concept exploit is available on GitHub, and the vulnerability carries a low CVSS score of 2.4 due to requiring high privileges and user interaction, but the published exploit status indicates active reconnaissance and potential targeted exploitation.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s1.php file where the 'sname' parameter is not properly sanitized. An unauthenticated attacker can remotely inject malicious JavaScript by manipulating this parameter, which will execute in the browsers of administrators or other users who view the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has an EPSS score indicating probable exploitation likelihood.
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint to database manipulation via the unsanitized USN parameter. Any network-accessible deployment is vulnerable to unauthenticated remote exploitation - no credentials or special configuration are required. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.07% (20th percentile) indicates no observed widespread automated exploitation at time of analysis, and no CISA KEV listing exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.
Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.
Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.
A Stored or Reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s5.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript code through this parameter, which will execute in the context of other users' browsers when they interact with the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has a low CVSS score of 2.4 due to high privilege requirements and user interaction dependency, but the public disclosure increases practical exploitation likelihood.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s2.php endpoint where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the browser of other users who view the affected page, potentially leading to session hijacking, credential theft, or administrative action manipulation. A public proof-of-concept exploit is available on GitHub, and the vulnerability carries a low CVSS score of 2.4 due to requiring high privileges and user interaction, but the published exploit status indicates active reconnaissance and potential targeted exploitation.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s1.php file where the 'sname' parameter is not properly sanitized. An unauthenticated attacker can remotely inject malicious JavaScript by manipulating this parameter, which will execute in the browsers of administrators or other users who view the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has an EPSS score indicating probable exploitation likelihood.
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint to database manipulation via the unsanitized USN parameter. Any network-accessible deployment is vulnerable to unauthenticated remote exploitation - no credentials or special configuration are required. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.07% (20th percentile) indicates no observed widespread automated exploitation at time of analysis, and no CISA KEV listing exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.