CVE-2026-4575

Vulnerability

Overview

CVE-2026-4575 describes a stored cross-site scripting (XSS) flaw in code-projects Exam Form Submission version 1.0. The issue resides in the /admin/update_s2.php file, where the sname parameter is directly output to the web page without proper encoding or filtering. This lack of input validation allows an attacker to inject malicious script code, which is then executed in the context of the victim's browser [1].

Exploitation

The attack can be initiated remotely without requiring authentication or special privileges. An attacker can craft a URL containing a malicious payload in the sname parameter, such as ``, and trick an administrator or user into visiting the crafted link. The vulnerability is publicly documented and a proof-of-concept has been published [1].

Impact

Successful exploitation enables an attacker to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim, deface web pages, redirect users to malicious sites, or gain control over the victim's browser. This poses a serious threat to user privacy and system security [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The recommended mitigation is to implement proper output encoding for all user-supplied input before rendering it in web pages. Administrators should consider disabling or restricting access to the vulnerable script until a fix is applied [1].