Description
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Published: 2026-03-30
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting via the sname parameter in /admin/update_fst.php
Action: Immediate Patch
AI Analysis

Impact

An input parameter named sname in the /admin/update_fst.php script of code‑projects Exam Form Submission can be manipulated to inject arbitrary script code that is then echoed back to the user’s browser. This flaw allows a remote attacker to execute malicious scripts in the context of a victim’s session. The vulnerability is categorized as XSS (CWE‑79) and also relates to code injection (CWE‑94).

Affected Systems

The flaw exists in code‑projects Exam Form Submission 1.0. Any deployment using this version is considered vulnerable, as no further sub‑version information is provided.

Risk and Exploitability

The CVSS v3.1 score of 4.8 places the issue in the moderate range. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be triggered remotely by sending an HTTP request containing a crafted sname value, and an exploit has already been published. Therefore the likelihood of exploitation for exposed installations is potentially high, although the severity is moderate.

Generated by OpenCVE AI on March 30, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or update for Exam Form Submission 1.0 as soon as it becomes available.
  • Limit access to the /admin/update_fst.php page to authenticated administrators or otherwise restrict it from public access.
  • Validate and encode all input for the sname parameter on the server side before outputting it to the page.
  • Consider implementing a web‑application firewall rule that detects and blocks common XSS payloads targeting the sname field.

Generated by OpenCVE AI on March 30, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 04:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Title code-projects Exam Form Submission update_fst.php cross site scripting
First Time appeared Code-projects
Code-projects exam Form Submission
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects exam Form Submission
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Exam Form Submission
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:51:54.907Z

Reserved: 2026-03-29T17:52:11.498Z

Link: CVE-2026-5106

cve-icon Vulnrichment

Updated: 2026-03-30T13:13:52.687Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-30T05:15:59.380

Modified: 2026-03-30T15:39:00.957

Link: CVE-2026-5106

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:03:42Z

Weaknesses