CVE-2026-14706
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in the Online Examination 1.0 system in the quiz creation feature. An attacker can remotely manipulate the name/total/right/wrong/time/tag/desc arguments in /update.php?q=addquiz, leading to SQL injection. The exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover. The publicly available exploit increases the likelihood of a rapid attack.
Recommendation
Immediately implement parameterized queries or prepared statements in /update.php. It is also recommended to update the system to the latest version or apply a security patch.
Original NVD description (English source)
A vulnerability was identified in code-projects Online Examination 1.0. This affects an unknown part of the file /update.php?q=addquiz of the component Quiz Creation Feature. The manipulation of the argument name/total/right/wrong/time/tag/desc leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.