PT-2026-28672 · Code Projects · Exam Form Submission

Niuzzz · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-4909

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions code-projects Exam Form Submission version 1.0

Description A cross-site scripting issue exists due to the manipulation of the sname argument in the file '/admin/update s7.php'. The issue impacts an unknown function. The exploit has been publicly released and could be used for remote attacks.

Recommendations Apply updates to address the issue in version 1.0. As a temporary workaround, restrict access to the file /admin/update s7.php. Avoid using the sname parameter in the affected file /admin/update s7.php until the issue is resolved.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-4909

Affected Products

Exam Form Submission

References · 9

• 🔥 https://github.com/Niuzzz123/CVE-Niuzzz/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4909 · Security Note
• https://vuldb.com/?id.353660 · Note
• https://twitter.com/CVEarity/status/2037513344182313186 · Twitter Post
• https://vuldb.com/?submit.777502 · Note
• https://twitter.com/cyberbivash/status/2037406361248514079 · Twitter Post
• https://twitter.com/CVEnew/status/2037513379233894712 · Twitter Post
• https://vuldb.com/?ctiid.353660 · Note
• https://code-projects.org · Note