Executive brief
A security vulnerability exists in the code-projects Project Management System, a tool used for managing organizational tasks and communication. The flaw is located in the mail and feedback components, where the system fails to properly clean user-submitted messages. An attacker can use this to inject malicious scripts that run in the browsers of other users, potentially leading to unauthorized actions or the theft of sensitive session information when they view their messages.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Project Management System 1.0 within the Mail Compose and Feedback components (specifically /mail.php and /view.php). The root cause is the failure to sanitize user-controlled input before storing it in the database and the subsequent failure to encode output when rendering message content in HTML. A remote authenticated attacker (such as a student or faculty member) can submit a malicious payload that executes in the context of another user's browser session when they view the affected mail or feedback pages. While the reported CVSS score is low (3.5), the vulnerability allows for persistent script execution. No official patch is currently documented.
Affected products
- code-projects Project Management System 1.0
Timeline
- 2026-06-28: disclosed: Exploit disclosed to the public
- 2026-06-28: advisory