CVE-2026-5106
Cross-Site Scripting in Exam Form Submission /admin/update_fst.php
Publication date: 2026-03-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | exam_form_submission | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5106 is a cross-site scripting (XSS) vulnerability found in version 1.0 of the Exam Form Submission project, specifically in the '/admin/update_fst.php' file.
The vulnerability occurs because the application directly outputs user input from the 'sname' parameter to the web page without proper encoding or filtering.
This lack of input validation and output encoding allows attackers to inject malicious JavaScript code, which executes in the victim's browser.
Exploitation does not require user login or authorization, and attackers can use this to perform unauthorized actions such as stealing cookies, session tokens, defacing web pages, redirecting users to malicious sites, and potentially gaining control over the victim’s browser.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you visit the affected web application.
- Stealing cookies and session tokens, which can lead to account hijacking.
- Defacing web pages, altering the appearance or content of the site.
- Redirecting users to malicious websites that may host further attacks or phishing attempts.
- Potentially gaining control over the victim’s browser to perform unauthorized actions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'sname' parameter in the /admin/update_fst.php file for cross-site scripting (XSS) issues. One common method is to inject a test payload such as <script>prompt(/xss/);</script> into the 'sname' parameter and observe if the script executes in the browser.
For example, you can use curl or a browser to send a request like:
- curl -G --data-urlencode "sname=<script>prompt(/xss/);</script>" https://your-target-domain/admin/update_fst.php
If the payload executes (e.g., a prompt box appears), it confirms the presence of the XSS vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps for this vulnerability include:
- Properly encode all user inputs based on the context (HTML, JavaScript, CSS, URL) to ensure inputs are treated as text rather than executable code.
- Implement strict input validation and filtering to allow only expected formats and reject or escape potentially harmful content such as script tags and event handlers.
- Deploy a strict Content Security Policy (CSP) to restrict script sources and prevent execution of unauthorized inline or external scripts.
- Set HttpOnly and Secure flags on sensitive cookies to prevent access via JavaScript and ensure transmission only over HTTPS.
- Conduct regular security audits and code reviews to detect and fix XSS and other vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The cross-site scripting (XSS) vulnerability in Exam Form Submission 1.0 can lead to unauthorized actions such as stealing cookies, session tokens, or other sensitive information. This exposure of sensitive data can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Failure to properly validate and encode user inputs, as well as to implement security controls like Content Security Policy and secure cookie flags, increases the risk of data breaches. Such breaches can result in non-compliance with regulatory requirements for data privacy and security, potentially leading to legal and financial consequences.