CVE-2026-14657
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.
Risk Assessment
The risk includes remote database compromise, data leakage, and potential privilege escalation within the system.
Recommendation
Immediately update the system to the latest version or apply a security patch. Until then, restrict access to /lecturer/marking-scheme.php and validate all input parameters.
Original NVD description (English source)
A flaw has been found in code-projects Assessment Management 1.0. This issue affects some unknown processing of the file /lecturer/marking-scheme.php of the component Database Query Handler. This manipulation of the argument squestions[] causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.