Description
A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-03-23
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The Exam Form Submission 1.0 web application contains a reflected cross‑site scripting flaw in an unnamed function of /admin/update_s4.php. By manipulating the sname query parameter it is possible to inject arbitrary script code that the victim’s browser will execute. The weakness is classified as CWE‑79 and is related to untrusted input handling as indicated by CWE‑94. An attacker who succeeds can run JavaScript in the context of the affected user, potentially compromising credentials, hijacking sessions or defacing the site.

Affected Systems

The only confirmed affected product is code‑projects Exam Form Submission version 1.0. No other vendor or product versions are listed as vulnerable.

Risk and Exploitability

The CVSS base score of 4.8 places this flaw in the medium risk range. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, yet the flaw can be triggered remotely and public exploits have been shared. Attackers only need to craft a request that includes malicious content in the sname argument; if the application fails to sanitize it, the script will run in the victim’s browser.

Generated by OpenCVE AI on March 23, 2026 at 07:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Exam Form Submission release from code‑projects, ensuring that the update_s4.php file contains the security fix.
  • If a newer version is unavailable, edit update_s4.php to encode or otherwise sanitize the sname parameter before it is reflected in the page output.
  • Verify the fix by submitting test payloads containing <script> tags and confirming they are not executed by the browser.
  • Monitor server logs and application behavior for any signs of reflected XSS activity or anomalous script execution.

Generated by OpenCVE AI on March 23, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 06:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Title code-projects Exam Form Submission update_s4.php cross site scripting
First Time appeared Code-projects
Code-projects exam Form Submission
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects exam Form Submission
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Exam Form Submission
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-23T11:36:34.810Z

Reserved: 2026-03-22T08:51:15.459Z

Link: CVE-2026-4577

cve-icon Vulnrichment

Updated: 2026-03-23T11:36:29.797Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-23T07:16:07.443

Modified: 2026-03-23T14:31:37.267

Link: CVE-2026-4577

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:49:37Z

Weaknesses