Executive brief
A security vulnerability exists in the code-projects Online Examination System, a web application used for managing and taking academic tests. An attacker can exploit this flaw to execute malicious scripts in the browser of a student who is currently logged into the system. This could lead to the theft of login sessions, unauthorized access to student data, or the performance of actions on the student's behalf without their knowledge.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the 'account.php' file of the Online Examination System 1.0. The root cause is the improper neutralization of user-supplied input in the 'eid', 'n', and 't' GET parameters, which are concatenated directly into the HTML form action attribute without output encoding. While the attack is launched remotely via a crafted URL, it requires a victim to have an active authenticated student session, as the page checks for a valid session email before rendering. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking or sensitive data disclosure. No official patch has been reported.
Affected products
- code-projects Online Examination System 1.0
Timeline
- 2026-07-19: disclosed: Exploit details and vulnerability report published publicly.
- 2026-07-19: advisory: CVE-2026-16220 published.