Executive brief
A security vulnerability exists in code-projects Assessment Management 1.0, a web application used for managing academic or organizational assessments. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login sessions, unauthorized changes to user accounts, or the exposure of sensitive information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management 1.0 within the 'admin/remove-user.php' script. The vulnerability is caused by improper neutralization of user-supplied input in the 'id' GET parameter before it is rendered in the HTML response. Specifically, the application reflects the 'id' value into an input field's value attribute without proper HTML entity encoding. A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload; when an authenticated user (such as an administrator) visits this URL, the script executes in their browser context. This can result in session hijacking or unauthorized administrative actions. Public exploit code (PoC) is available.
Affected products
- code-projects Assessment Management 1.0
Timeline
- 2026-07-04: disclosed: Public disclosure of the vulnerability and exploit code.
- 2026-07-04: advisory