Description
A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the /admin/remove‑user.php endpoint of code‑projects Assessment Management version 1.0. By manipulating the ID query argument, an attacker can cause the application to echo back unescaped input, resulting in reflected cross‑site scripting that can run arbitrary scripts in the victim’s browser. The flaw can be triggered remotely via a crafted HTTP GET request and does not require authentication.

Affected Systems

Only the code‑projects Assessment Management product, specifically version 1.0, is affected. Any installation exposing the /admin/remove‑user.php path without the vendor fix remains vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 5.3 indicates a moderate impact. With an EPSS of less than 1 % and no listing in the CISA KEV catalog, the likelihood of exploitation at present is low. Attackers can reach the vulnerable endpoint from any network location that can reach the web application and supply a malicious ID value to induce the XSS flaw.

Generated by OpenCVE AI on July 31, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or update that sanitizes the ID parameter in /admin/remove‑user.php
  • Validate or escape the ID query value on the server side before rendering the page
  • Add a Content‑Security‑Policy header that disallows inline scripts or restricts script sources to trusted origins

Generated by OpenCVE AI on July 31, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title code-projects Assessment Management remove-user.php cross site scripting
First Time appeared Code-projects
Code-projects assessment Management
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects assessment Management
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Assessment Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:51:07.971Z

Reserved: 2026-07-03T18:50:27.237Z

Link: CVE-2026-14656

cve-icon Vulnrichment

Updated: 2026-07-06T16:46:04.756Z

cve-icon NVD

Status : Deferred

Published: 2026-07-04T22:16:42.553

Modified: 2026-07-06T18:16:38.540

Link: CVE-2026-14656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T14:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')