CVE-2026-93975
Received Received - Intake

Cross-Site Scripting in Assessment Management 1.0

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-93975
EUVD
EUVD-2026-83718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects assessment_management 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in an assessment management system. The flaw exists in the admin/edit-user.php file where user inputs like name, surname, email, username, password, or ID are not properly sanitized before being stored in the database. The application only escapes SQL special characters but fails to prevent HTML or JavaScript injection. When these stored values are later displayed, they are rendered directly in HTML without encoding, allowing attackers to inject malicious scripts.

Detection Guidance

To detect this vulnerability, inspect the admin/edit-user.php file in your Assessment Management system for improper input sanitization. Check if user inputs like name, surname, email, or username are directly stored without HTML encoding. Test by submitting payloads like "><script>alert(999)</script> in these fields and verify if they execute when rendered.

Impact Analysis

An attacker could exploit this to inject malicious scripts into user input fields. When other users view the affected pages, these scripts execute, potentially leading to session hijacking, stealing cookies, or phishing attacks. The username field may also allow reflected XSS if the ID parameter is missing from the database.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA due to the potential for stored cross-site scripting (XSS). If exploited, it may allow attackers to steal session cookies or sensitive user data, violating data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Mitigation Strategies

Immediately update the admin/edit-user.php file to use proper output encoding (e.g., htmlspecialchars()) when rendering user inputs. Replace mysqli_real_escape_string() with prepared statements for database interactions. Additionally, implement input validation to restrict allowed characters in user fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart