CVE-2026-4557

Vulnerability

Overview

A cross-site scripting (XSS) vulnerability has been identified in code-projects Exam Form Submission version 1.0. The issue resides in the /admin/update_s1.php file, where the sname parameter is processed. The root cause is that user-supplied input is directly output to the web page without proper encoding or filtering, allowing an attacker to inject arbitrary HTML and JavaScript code [1].

Exploitation

The attack can be initiated remotely and does not require authentication or any special privileges. An attacker can craft a malicious payload, such as `, and submit it via the sname` parameter. When an administrator or other user accesses the affected page, the affected page, the injected script executes in their browser [1].

Impact

Successful exploitation enables an attacker to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim, deface web pages, redirect users to malicious sites, or even gain control of the victim's browser. This poses a serious threat to user privacy and system security [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The recommended fix is to properly encode all user input before outputting it to web pages, specifically by encoding the sname parameter. Users should also consider implementing a Content Security Policy (CSPolicy (CSP) to reduce the risk of script injection [1].