CVE-2026-14705

HighCVSS 7.3

Published: 05/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A SQL injection vulnerability was found in code-projects Online Examination 1.0 in the head.php file. Manipulating the uname or password arguments allows remote exploitation. The exploit has been publicly disclosed and may be used.

Risk Assessment

An attacker can gain unauthorized access to the database, steal or modify exam data and user accounts, compromising the confidentiality and integrity of the system.

Recommendation

Immediately update the system to the latest version or apply a patch that prevents SQL injection, e.g., by using parameterized queries. Until the fix is applied, restrict access to the head.php file.

Other vulnerabilities in Online Examination

CVE-2026-14706Medium
A SQL injection vulnerability was found in the Online Examination 1.0 system in the quiz creation feature. An attacker can remotely manipulate the name/total/right/wrong/time/tag/desc arguments in /update.php?q=addquiz, leading to SQL injection. The exploit is publicly available.

Original NVD description (English source)

A vulnerability was determined in code-projects Online Examination 1.0. Affected by this issue is some unknown functionality of the file head.php. Executing a manipulation of the argument uname/password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.