Code Projects: Six SQLi and XSS Vulnerabilities Disclosed Together, Exploits Publicly Available
Six vulnerabilities, including SQL injection and XSS flaws, were disclosed for Code Projects' Internship and Assessment Management Systems, all with publicly available exploits.
Key findings
- Six vulnerabilities disclosed together for Code Projects' Internship and Assessment Management Systems.
- Three High-severity SQL injection flaws in login forms of Internship Management System 1.0.
- Three Low-severity XSS flaws in Assessment Management System 1.0.
- Publicly available exploits exist for all disclosed vulnerabilities.
- All affected systems are version 1.0.
On September 20, 2026, a batch of six vulnerabilities was disclosed for Code Projects' Internship Management System and Assessment Management software. The vulnerabilities, disclosed within a one-hour window, include three SQL injection flaws and three cross-site scripting (XSS) issues. The SQL injection vulnerabilities, all rated High severity with a CVSSv3 score of 7.3, affect the Admin Login Form, Employer Login Form, and a general login form within the Internship Management System 1.0. These flaws stem from the manipulation of the 'Password' argument and can be exploited remotely.
The three Cross-Site Scripting (XSS) vulnerabilities, rated Low severity, impact the Assessment Management 1.0 software. CVE-2026-93977, with a CVSSv3 score of 3.5, affects the lecturer/add-single-mark.php file due to manipulation of the 'mark' argument. CVE-2026-93976 and CVE-2026-93975, both with a CVSSv3 score of 2.4, affect the admin/add-user.php and admin/edit-user.php files respectively. These XSS vulnerabilities are triggered by manipulating arguments such as 'level', 'name', 'sname', 'email', 'username', 'password', and 'id'. All three XSS vulnerabilities can be exploited remotely.
For all six disclosed vulnerabilities, exploits have been released to the public and may be in use. The specific components and files affected are within version 1.0 of both the Internship Management System and the Assessment Management software. No specific vendor advisories or patch information were provided for this batch of vulnerabilities.
This coordinated disclosure highlights significant security weaknesses in Code Projects' management systems. The presence of publicly available exploits for both high-severity SQL injection flaws and lower-severity XSS vulnerabilities necessitates immediate attention from users of these systems. Organizations utilizing the Internship Management System 1.0 and Assessment Management 1.0 should be aware of the potential for remote exploitation and the availability of attack tools.
The SQL injection vulnerabilities, CVE-2026-93980, CVE-2026-93979, and CVE-2026-93978, all target login functionalities by exploiting the 'Password' field. This suggests a common underlying weakness in how these login forms handle user input, potentially allowing attackers to inject malicious SQL code to bypass authentication or access sensitive data.
Similarly, the XSS vulnerabilities, CVE-2026-93977, CVE-2026-93976, and CVE-2026-93975, demonstrate a pattern of insecure handling of user-supplied data in various administrative and lecturer-facing functions. Attackers could leverage these flaws to execute malicious scripts in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.
Given that exploits are publicly available for all disclosed CVEs, the risk of these vulnerabilities being actively exploited in the wild is high. Users of Code Projects' Internship Management System and Assessment Management software are strongly advised to investigate mitigation strategies and await official patches or security guidance from the vendor. The tight disclosure window suggests a coordinated effort by researchers or security firms to bring these issues to light simultaneously.
The batch includes:
- SQL Injection (High Severity): CVE-2026-93980, CVE-2026-93979, CVE-2026-93978
- Cross-Site Scripting (Low Severity): CVE-2026-93977, CVE-2026-93976, CVE-2026-93975
The commonality in affected versions (1.0) and the nature of the vulnerabilities (SQLi and XSS) point to systemic security issues within these Code Projects applications. The remote exploitability and public availability of exploits amplify the urgency for users to address these security concerns.