Description
A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.php. Executing a manipulation of the argument User can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-07-04
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the admin/view-users.php script of code-projects Assessment Management allows an attacker to inject arbitrary JavaScript by manipulating the User parameter. The vulnerability is a classic cross-site scripting (CWE‑79). An exploit can execute malicious script in the context of any user who visits the page, potentially enabling unauthorized client‑side attacks.

Affected Systems

Only code‑projects Assessment Management is listed as affected. No version number is specified, so the flaw could apply to any release until a patch is issued.

Risk and Exploitability

The CVSS score of 4.8 indicates a low severity, while the EPSS score of <1% reflects a very low historical exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but it is publicly disclosed and can be triggered remotely by sending a crafted request that modifies the User query string. Because the flaw resides in a server‑generated page, it can be exploited without requiring privileged access on the host.

Generated by OpenCVE AI on July 24, 2026 at 09:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy any available vendor patch or upgrade to a release where the XSS flaw in admin/view‑users.php has been fixed.
  • Add server‑side validation and escaping for the User parameter, ensuring that any data returned in admin view‑users.php is properly encoded before output.
  • Restrict administrative access to authenticated users only, and the admin interface.

Generated by OpenCVE AI on July 24, 2026 at 09:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.php. Executing a manipulation of the argument User can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title code-projects Assessment Management view-users.php cross site scripting
First Time appeared Code-projects
Code-projects assessment Management
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects assessment Management
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Assessment Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:37:00.901Z

Reserved: 2026-07-03T18:50:24.033Z

Link: CVE-2026-14655

cve-icon Vulnrichment

Updated: 2026-07-07T02:36:57.022Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')