CVE-2026-93975
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability has been found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/edit-user.php (User Editing component). Manipulation of the name/sname/email/username/password/id arguments leads to cross site scripting, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
Cross site scripting in user editing may allow an attacker to execute malicious script in a victim's browser, risking session theft, account takeover, or data manipulation.
Recommendation
Implement validation and encoding for all listed arguments and apply security headers such as Content-Security-Policy to reduce XSS risk.
Other vulnerabilities in Assessment Management
See all- CVE-2026-93977Low
A vulnerability was determined in code-projects Assessment Management 1.0 affecting an unknown functionality of the file lecturer/add-single-mark.php. Manipulation of the mark argument causes cross site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-93976Low
A vulnerability was found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/add-user.php. Manipulation of the level argument results in cross site scripting, and the attack may be launched remotely. The exploit has been made public and could be used.
- CVE-2026-76762High
A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
- CVE-2026-14658Medium
A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14657Medium
A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.
- CVE-2026-14656Medium
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.
- CVE-2026-14655Low
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the admin/view-users.php file via the User argument. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS