CVE-2026-93977
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was determined in code-projects Assessment Management 1.0 affecting an unknown functionality of the file lecturer/add-single-mark.php. Manipulation of the mark argument causes cross site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
Cross site scripting may allow an attacker to execute malicious script in a user's browser, risking session theft, account takeover, or content manipulation.
Recommendation
Implement input validation and output encoding for the mark argument and apply security headers such as Content-Security-Policy to mitigate XSS impact.
Other vulnerabilities in Assessment Management
See all- CVE-2026-93976Low
A vulnerability was found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/add-user.php. Manipulation of the level argument results in cross site scripting, and the attack may be launched remotely. The exploit has been made public and could be used.
- CVE-2026-93975Low
A vulnerability has been found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/edit-user.php (User Editing component). Manipulation of the name/sname/email/username/password/id arguments leads to cross site scripting, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-76762High
A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
- CVE-2026-14658Medium
A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14657Medium
A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.
- CVE-2026-14656Medium
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.
- CVE-2026-14655Low
A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the admin/view-users.php file via the User argument. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS