Description
A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The manipulation of the argument smarksrange[] results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the smarksrange[] parameter of the /lecturer/marking-scheme.php script allows an attacker to inject arbitrary SQL code into the application’s database. The vulnerability is identified as CWE-74 and CWE-89. If exploited, an attacker could read, modify, or delete database records, thereby compromising the confidentiality and integrity of the stored data.

Affected Systems

code-projects Assessment Management version 1.0 is affected. The flaw resides in the marking-scheme.php file accessed via the web interface. No other versions are mentioned, and the application uses a relational database.

Risk and Exploitability

The attack can be launched remotely over HTTP. The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low short‑term exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. No authentication prerequisite is noted, which could broaden the potential impact.

Generated by OpenCVE AI on July 24, 2026 at 09:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch as soon as it becomes available.
  • Restrict access to /lecturer/marking-scheme.php so that only authenticated lecturer accounts can invoke it, blocking unauthenticated or low‑privilege users.
  • Configure strict input validation on the smarksrange[] parameter, accepting only numeric values and rejecting any data containing special characters or SQL control syntax.
  • Modify the application code to use parameterized SQL queries or prepared statements, eliminating the use of unsanitized user input in database calls.
  • Ensure the database user account used by Assessment Management has only the minimal privileges required for its operations; avoid granting superuser or administrative rights.

Generated by OpenCVE AI on July 24, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The manipulation of the argument smarksrange[] results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Title code-projects Assessment Management marking-scheme.php sql injection
First Time appeared Code-projects
Code-projects assessment Management
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects assessment Management
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Assessment Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:43:09.707Z

Reserved: 2026-07-03T18:50:32.861Z

Link: CVE-2026-14658

cve-icon Vulnrichment

Updated: 2026-07-06T13:43:05.568Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')