Description
A flaw has been found in code-projects Assessment Management 1.0. This issue affects some unknown processing of the file /lecturer/marking-scheme.php of the component Database Query Handler. This manipulation of the argument squestions[] causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Code‑Projects Assessment Management 1.0 enables an attacker to manipulate the squestions[] parameter in the /lecturer/marking-scheme.php endpoint, resulting in a classic SQL injection condition. This weakness arises from insufficient input validation (CWE‑74) and (CWE‑89). Successful exploitation could allow an attacker to read, modify, or delete records in the underlying database, potentially exposing student data, grades, or other confidential information.

Affected Systems

The Code‑Projects Assessment Management application, version 1.0, is affected; no data regarding other versions or related products is provided.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. An EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is remote, originating from an external system, and a concept exploit has been published, implying the possibility of real‑world attacks.

Generated by OpenCVE AI on July 24, 2026 at 09:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update or patch the Assessment Management application to a version that removes the SQL injection flaw.
  • Validate the squestions[] input strictly, ensuring only allowed values are accepted before it is used in database queries.
  • Replace the vulnerable string concatenation code with parameterized queries or prepared statements to the /lecturer/marking-scheme.php endpoint.

Generated by OpenCVE AI on July 24, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Assessment Management 1.0. This issue affects some unknown processing of the file /lecturer/marking-scheme.php of the component Database Query Handler. This manipulation of the argument squestions[] causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Title code-projects Assessment Management Database Query marking-scheme.php sql injection
First Time appeared Code-projects
Code-projects assessment Management
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects assessment Management
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Assessment Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:19:01.343Z

Reserved: 2026-07-03T18:50:29.860Z

Link: CVE-2026-14657

cve-icon Vulnrichment

Updated: 2026-07-06T16:18:57.467Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')