Skip to main content

Projectworlds

Vendor security scorecard – 1 CVEs in the selected period

Period: 30d 90d 6m 1y All
Risk 8
1
CVEs
0
Critical
0
High
0
KEV
1
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS

Severity Breakdown

CRITICAL
0
HIGH
0
MEDIUM
0
LOW
1

Monthly CVE Trend

Top Risky CVEs

CVE Summary Severity CVSS EPSS Priority Signals
CVE-2026-86238 Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis. LOW 2.1 0.4% 31
PoC No patch

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy