CVE-2026-4557
Cross-Site Scripting in Exam Form Submission /admin/update_s1.php
Publication date: 2026-03-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | exam_form_submission | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The CVE-2026-4557 vulnerability is a Cross-Site Scripting (XSS) issue found in the "Exam Form Submission Project V1.0," specifically in the \'/admin/update_s1.php\' file.'}, {'type': 'paragraph', 'content': "The root cause is the improper handling of the 'sname' parameter, where user input is directly output to the web page without adequate encoding or filtering."}, {'type': 'paragraph', 'content': "This flaw allows attackers to inject malicious scripts, which execute in the victim's browser, enabling unauthorized actions such as stealing cookies, session tokens, sensitive information, defacing web pages, redirecting users to malicious sites, and potentially taking control of the victim's browser."}, {'type': 'paragraph', 'content': 'Notably, exploitation requires no login or authorization.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you visit the affected web application.
- Stealing cookies and session tokens, which can lead to account hijacking.
- Accessing sensitive information displayed or stored in the browser.
- Defacing web pages or altering the content you see.
- Redirecting you to malicious websites without your consent.
- Potentially taking control of your browser to perform unauthorized actions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "The vulnerability is a Cross-Site Scripting (XSS) issue in the '/admin/update_s1.php' file, specifically involving the 'sname' parameter. Detection can be performed by testing this parameter for script injection."}, {'type': 'list_item', 'content': "Use a web browser or tools like curl or wget to send requests with a payload such as `<script>prompt(/xss/);</script>` in the 'sname' parameter and observe if the script executes or is reflected unencoded in the response."}, {'type': 'list_item', 'content': 'Example curl command to test the vulnerability: `curl -G --data-urlencode "sname=<script>prompt(/xss/);</script>" https://targetsite/admin/update_s1.php`'}, {'type': 'list_item', 'content': "Use web vulnerability scanners that support XSS detection to automate testing of the 'sname' parameter."}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate remediation steps include:'}, {'type': 'list_item', 'content': "Implement proper output encoding for the 'sname' parameter based on the context (HTML, JavaScript, CSS, URL) to ensure user input is treated as text, not executable code."}, {'type': 'list_item', 'content': 'Enforce strict input validation and filtering to accept only expected input formats and sanitize or reject potentially malicious content such as script tags or event handlers.'}, {'type': 'list_item', 'content': 'Deploy a strict Content Security Policy (CSP) to restrict script sources and prevent unauthorized inline or external script execution.'}, {'type': 'list_item', 'content': 'Set HttpOnly and Secure flags on sensitive cookies to prevent JavaScript access and ensure cookies are transmitted only over HTTPS.'}, {'type': 'list_item', 'content': 'Conduct regular security audits and code reviews to detect and fix XSS and other vulnerabilities promptly.'}] [1]