CVE-2026-4972

LowCVSS 2.4

Published: 27/03/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was detected in the Online Reviewer System up to version 1.0. Manipulation of the Description argument in /system/system/students/assessments/databank/btn_functions.php allows a remote attack, and a public exploit is already available.

Risk Assessment

An attacker could execute malicious script in a victim's browser, hijack sessions, or perform actions on their behalf; the public availability of the exploit increases the likelihood of abuse.

Recommendation

Implement input validation and encoding for the Description argument and consider applying fixes or restricting access to the application until patches are available.

Other vulnerabilities in Online Reviewer System

CVE-2026-108948Medium
A vulnerability in Online Reviewer System (code-projects) version 1.0. Unknown code in file /reviewer/system/system/admins/manage/users/btn_functions.php of the User Profile Update Handler has an issue with the usertype_id argument, leading to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public.

Original NVD description (English source)

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS