CVE-2026-1421

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-26

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-26

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-01-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-1421

EUVD

EUVD-2026-4700

Affected Vendors & Products

Vendor	Product	Version / Range
fabian	online_examination_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-1421 is a stored cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Online Examination System, specifically affecting multiple 'add' pages within the 'Add Pages' component. The system fails to properly neutralize user-controllable input before embedding it into web pages, allowing remote attackers to inject malicious scripts that execute when other users view the affected pages. Exploitation requires some user interaction and can be done remotely without local access. This vulnerability compromises data integrity and is classified as CWE-79. [1, 3]

Impact Analysis

This vulnerability can allow remote attackers to execute malicious scripts in the context of the affected web application, potentially leading to unauthorized actions performed on behalf of users, manipulation of displayed content, or theft of sensitive information such as session tokens. Since the XSS is stored, the malicious code persists and affects multiple users who access the compromised pages. This can undermine user trust, lead to data integrity issues, and facilitate further attacks. [1, 3]

Detection Guidance

This vulnerability can be detected by testing the input fields on the affected 'add' pages (/onexam/add_visitor.php, /onexam/add_offering.php, /onexam/add_teen.php, /onexam/admin_user.php) for stored cross-site scripting (XSS) by injecting typical XSS payloads such as <script>alert(1)</script> and observing if the script executes when the data is viewed. Since the vulnerability involves stored XSS, monitoring HTTP requests and responses for suspicious script tags in input fields and stored data can help detect exploitation attempts. Specific commands are not provided in the resources, but using tools like curl or Burp Suite to send crafted POST requests with XSS payloads to these endpoints can be effective. [3, 1]

Mitigation Strategies

No known countermeasures or mitigations have been identified for this vulnerability. The suggested immediate step is to replace the affected product with an alternative that is not vulnerable. Additionally, restricting user input or applying input validation and output encoding could help, but no official fixes or patches are available as per the provided resources. [1]

Hi! I’m here to help you understand CVE-2026-1421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70