CVE-2026-4577

Root

Cause

A reflected cross-site scripting (XSS) vulnerability has been identified in code-projects Exam Form Submission version 1.0. The vulnerability resides in the /admin/update_s4.php file, where the sname parameter is processed. The root cause is that user-supplied input is directly output to the web page without proper encoding or filtering, enabling an attacker to inject malicious script code [1].

Exploitation

The attack can be initiated remotely and does not require authentication or authorization [1]. An attacker can craft a URL containing a payload in the sname parameter, such as ``, and deliver it to a victim. When the victim accesses the crafted URL, the script executes in their browser context.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to theft of cookies, session tokens, or other sensitive information, as well as performing actions on behalf of the victim, defacing web pages, redirecting users to malicious sites, or potentially gaining control of the victim's browser [1].

Mitigation

As of the publication date, the vendor has not released a patch. The recommended remediation is to implement proper output encoding for all user input when rendering on web pages, and to validate and sanitize the sname parameter [1]. Users should consider applying input validation and output encoding as a workaround until an official fix is available.