CVE-2026-86238
Received Received - Intake

Cross-Site Scripting in Online Examination System 1.0

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86238
EUVD
EUVD-2026-72186

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
projectworlds online_examination_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Online Examination System Project version 1.0. The issue is in the feedback.php file where the Name and Subject fields are not properly sanitized before being stored in the database. When an administrator views the feedback on the dashboard, the unsanitized input is rendered as JavaScript, allowing arbitrary code execution in the admin's authenticated session.

Detection Guidance

To detect this stored XSS vulnerability, inspect the feedback.php file for improper input handling in Name/Subject fields. Check if user input is directly rendered without sanitization. Manually submit test payloads like <script>alert(1)</script> in these fields and verify if they execute when viewed by an admin on dash.php?q=3.

  • Check feedback.php for unsanitized user input handling in Name/Subject fields.
  • Submit test XSS payloads in feedback form and observe if they execute in admin dashboard.
Impact Analysis

An attacker can exploit this by submitting malicious scripts in the Name or Subject fields. This could lead to session hijacking, cookie theft, CSRF token exfiltration, or full admin account takeover. The impact is limited to the admin's session if they view the feedback.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as user credentials or personal information, which may violate GDPR and HIPAA compliance requirements for data protection and confidentiality.

Mitigation Strategies

Immediately apply output encoding to Name/Subject fields in feedback.php using functions like htmlspecialchars() before storing or rendering input. Ensure all user-supplied data is sanitized to prevent XSS execution in admin sessions.

  • Implement output encoding (e.g., htmlspecialchars()) for Name/Subject fields in feedback.php.
  • Sanitize all user input before database storage and rendering to prevent XSS execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart