CVE-2026-4909 - code-projects Exam Form Submission update_s7.php cross site scripting

Back Back to CVE browser

MEDIUM

code-projects Exam Form Submission update_s7.php cross site scripting

Published Mar 27, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.35%

Description

A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Vendor Code-Projects Product Exam Form Submission Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Code-Projects

Exam Form Submission

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (6)

https://code-projects.org/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16529
Advisory
https://github.com/Niuzzz123/CVE-Niuzzz/issues/1
exploitissue-tracking
https://vuldb.com/?ctiid.353660
signaturepermissions-required
https://vuldb.com/?id.353660
vdb-entrytechnical-description
https://vuldb.com/?submit.777502
third-party-advisory

Link	Providers	Tags
https://code-projects.org/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16529		Advisory
https://github.com/Niuzzz123/CVE-Niuzzz/issues/1		exploitissue-tracking
https://vuldb.com/?ctiid.353660		signaturepermissions-required
https://vuldb.com/?id.353660		vdb-entrytechnical-description
https://vuldb.com/?submit.777502		third-party-advisory