CVE-2026-14656
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.
Risk Assessment
An attacker can remotely execute a script in the administrator's browser, potentially leading to session hijacking, account takeover, or sensitive data theft.
Recommendation
Immediately update the system to the latest version or implement input filtering (validation and sanitization of the ID argument) and use Content-Security-Policy headers.
Other vulnerabilities in Assessment Management
See all- CVE-2026-76762High
A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
- CVE-2026-14658Medium
A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14657Medium
A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.
- CVE-2026-14655Low
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the admin/view-users.php file via the User argument. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.