CVE-2026-14658
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover.
Recommendation
Immediately apply a security patch from the vendor or temporarily disable access to /lecturer/marking-scheme.php. Also implement input validation and sanitization for all user inputs.
Original NVD description (English source)
A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The manipulation of the argument smarksrange[] results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.