CVE-2020-29205

MEDIUM

Project Worlds Online Examination System 1.0 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-29205. PoCs published by Nikhil Kumar.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in the 'name' field of the Online Examination System 1.0. The payload is injected during user registration and triggers when the user logs in, reflecting the cookie data.

Description

XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field

Exploits (1)

exploitdb WORKING POC
by Nikhil Kumar · textwebappsphp
https://www.exploit-db.com/exploits/48969

This exploit demonstrates a stored XSS vulnerability in the 'name' field of the Online Examination System 1.0. The payload is injected during user registration and triggers when the user logs in, reflecting the cookie data.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Online Examination System 1.0
No auth needed
Prerequisites: Access to the registration page · User interaction to trigger the payload
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/48969
Third Party Advisory x_refsource_misc
https://nikhilkumar01.medium.com/cve-2020-29205-a7ab5cbcd156

Scores

CVSS v3 6.1
EPSS 0.0153
EPSS Percentile 71.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
projectworlds/travel_management_system 1.0
Published May 17, 2021
Tracked Since Feb 18, 2026