CVE-2026-4969

LOW

code-projects Social Networking Site Alert home.php cross site scripting

Title source: cna

Description

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/?id.353856

[Signature, Permissions Required] https://vuldb.com/?ctiid.353856

[Third Party Advisory] https://vuldb.com/?submit.777815

[Exploit] https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20PHP%20Social%20Networking%20Site.md

View Exploit ZIP pw:eip

[Product] https://code-projects.org/

Scores

CVSS v3 3.5

EPSS 0.0004

EPSS Percentile 10.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

code-projects/Social Networking Site 1.0

Published Mar 27, 2026

Tracked Since Mar 29, 2026