CVE-2026-5106
LOWcode-projects Exam Form Submission update_fst.php cross site scripting
Title source: cnaDescription
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
Submit #780091 | code-projects Exam Form Submission V1.0 cross site scripting
https://vuldb.com/submit/780091
Product product
https://code-projects.org/
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-354131 | code-projects Exam Form Submission update_fst.php cross site scripting
https://vuldb.com/vuln/354131
Signature, Permissions Required signature
permissions-required
VDB-354131 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/354131/cti
Exploit exploit
issue-tracking
https://github.com/sxc2044-pixel/hajimi/issues/1
Scores
CVSS v3
2.4
EPSS
0.0019
EPSS Percentile
8.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
CWE-94
Status
published
Products (2)
code-projects/Exam Form Submission
1.0
code-projects/exam_form_submission
1.0
Published
Mar 30, 2026
Tracked Since
Mar 30, 2026