Description
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Published: 2026-03-30
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch Immediately
AI Analysis

Impact

A flaw in code-projects Exam Form Submission 1.0 allows an attacker to inject arbitrary JavaScript by manipulating the sname argument in /admin/update_fst.php. The vulnerability is a reflected cross‑site scripting (CWE-79) that also involves potential code execution through server‐side template injection (CWE-94). When exploited, the attacker can run scripts in the context of victim users, enabling session hijacking, cookie theft, or defacement of the web interface.

Affected Systems

The affected product is code‑projects Exam Form Submission version 1.0, as identified on the Code‑Projects website and the GitHub repository. The vulnerability resides in the admin module of this software, specifically the update_fst.php file.

Risk and Exploitability

The CVSS score of 4.8 indicates a medium impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Although not currently listed in the CISA KEV catalog, the exploit has been published and can be triggered remotely, meaning that vulnerable installations without protective controls are at risk of client‑side attacks.

Generated by OpenCVE AI on March 30, 2026 at 16:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the software to the latest release that addresses the XSS issue; if a patch is not available, upgrade to a newer version of Exam Form Submission.
  • Apply input validation and output encoding to the sname parameter to neutralize injected scripts.
  • Restrict access to /admin/update_fst.php to authenticated administrators only and implement rate limiting or web‑application firewall rules that block suspicious payloads.
  • Monitor web logs for anomalous requests to the update_fst.php endpoint and investigate any suspicious activity.

Generated by OpenCVE AI on March 30, 2026 at 16:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 04:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Title code-projects Exam Form Submission update_fst.php cross site scripting
First Time appeared Code-projects
Code-projects exam Form Submission
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:exam_form_submission:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects exam Form Submission
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Exam Form Submission
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:51:54.907Z

Reserved: 2026-03-29T17:52:11.498Z

Link: CVE-2026-5106

cve-icon Vulnrichment

Updated: 2026-03-30T13:13:52.687Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-30T05:15:59.380

Modified: 2026-03-30T15:39:00.957

Link: CVE-2026-5106

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T20:56:09Z

Weaknesses