CVE-2026-4578

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the file /admin/update_s3.php. The issue originates from the sname parameter, where user input is directly output to the web page without proper encoding or filtering, allowing an attacker to inject malicious script code [1].

The vulnerability can be exploited remotely without requiring any authentication or login. An attacker simply needs to craft a URL containing a malicious payload in the sname parameter, such as ``, and trick a victim into visiting it. The injected script then executes in the victim's browser [1].

Successful exploitation enables an attacker to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim, deface web pages, redirect users to malicious sites, or even gain control over the victim's browser. This poses a threat to user privacy and the security of the application [1].

As of the publication date (March 23, 2026), the vulnerability has been publicly disclosed with a proof-of-concept. The vendor recommends implementing output encoding for the sname parameter to mitigate the issue. No official patch has been mentioned, and the software version 1.0 is affected.