CVE-2026-14657

A vulnerability was determined in code-projects Assessment Management 1.0 affecting an unknown functionality of the file lecturer/add-single-mark.php. Manipulation of the mark argument causes cross site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/add-user.php. Manipulation of the level argument results in cross site scripting, and the attack may be launched remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/edit-user.php (User Editing component). Manipulation of the name/sname/email/username/password/id arguments leads to cross site scripting, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.

A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.

A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the admin/view-users.php file via the User argument. The attack can be performed remotely and the exploit is publicly available.