Is CVE-2026-14656 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14656 being exploited in the wild.

How severe is CVE-2026-14656?

Medium severity, with a CVSS score of 4.3, published 4 July 2026.

Which products and versions are affected?

Code-Projects Assessment Management System 1.0.

Is there a fix for CVE-2026-14656?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14656 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-14656?

Check whether you run Code-Projects Assessment Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14656: code-projects Assessment Management XSS in remove-user.php

CVE-2026-14656 · Severity: medium · CVSS 4.3 · Published 2026-07-04

A security vulnerability exists in code-projects Assessment Management 1.0, a web application used for managing academic or organizational assessments. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login sessions, unauthorized changes to user accounts, or the exposure of sensitive information.

Technologies: Code-Projects Assessment Management System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-14656 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14656 being exploited in the wild.
How severe is CVE-2026-14656?: Medium severity, with a CVSS score of 4.3, published 4 July 2026.
Which products and versions are affected?: Code-Projects Assessment Management System 1.0.
Is there a fix for CVE-2026-14656?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14656 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-14656?: Check whether you run Code-Projects Assessment Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management 1.0 within the 'admin/remove-user.php' script. The vulnerability is caused by improper neutralization of user-supplied input in the 'id' GET parameter before it is rendered in the HTML response. Specifically, the application reflects the 'id' value into an input field's value attribute without proper HTML entity encoding. A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload; when an authenticated user (such as an administrator) visits this URL, the script executes in their browser context. This can result in session hijacking or unauthorized administrative actions. Public exploit code (PoC) is available.

Affected products

code-projects Assessment Management 1.0

Timeline

2026-07-04: disclosed: Public disclosure of the vulnerability and exploit code.
2026-07-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.