CVE-2026-14658
Received Received - Intake

SQL Injection in Assessment Management 1.0

Publication date: 2026-07-04

Last updated on: 2026-07-04

Assigner: VulDB

Description
A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The manipulation of the argument smarksrange[] results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-04
Last Modified
2026-07-04
Generated
2026-07-05
AI Q&A
2026-07-05
EPSS Evaluated
N/A
NVD
CVE-2026-14658

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in code-projects Assessment Management 1.0, specifically in the file /lecturer/marking-scheme.php. It is caused by improper handling of the argument smarksrange[], which allows an attacker to perform SQL injection.

SQL injection is a technique where an attacker manipulates input parameters to execute arbitrary SQL commands on the database, potentially compromising data integrity and confidentiality.

The vulnerability can be exploited remotely, and a public exploit is available.

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized access to the database, allowing attackers to read, modify, or delete sensitive data.

Since the attack can be launched remotely, it increases the risk of data breaches without requiring physical access.

The impact includes potential loss of data integrity, confidentiality, and availability, which can disrupt normal operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart