CVE-2026-4577 describes a cross-site scripting (XSS) vulnerability discovered in code-projects Exam Form Submission version 1.0. This flaw allows an attacker to inject malicious scripts into the application, potentially compromising user data and session integrity. The vulnerability resides within the /admin/update_s4.php file, specifically in an unknown function. A public exploit is available, increasing the risk of exploitation.
Successful exploitation of CVE-2026-4577 enables an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious activities, including session hijacking, credential theft, and defacement of the application's interface. The attacker could potentially gain access to sensitive data stored within the application or redirect users to malicious websites. Given the public availability of an exploit, the risk of exploitation is elevated, particularly for systems that are not promptly patched.
CVE-2026-4577 has been publicly disclosed and a proof-of-concept exploit is available, indicating a moderate risk of exploitation. The vulnerability is not currently listed on CISA KEV. The LOW CVSS score reflects the relatively simple nature of the exploit and the potential for limited impact, but the public availability of the exploit warrants immediate attention.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-4577 is to upgrade to a patched version of Exam Form Submission. Since a fixed version is not specified, thoroughly review the code-projects repository for updates and security advisories. As a temporary workaround, implement strict input validation and output encoding on the 'sname' parameter within the /admin/update_s4.php file. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. After applying mitigation steps, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through the 'sname' parameter and confirming that it is properly sanitized.
Actualizar a una versión parcheada o aplicar las medidas de seguridad necesarias para evitar la inyección de código malicioso a través del parámetro 'sname' en el archivo '/admin/update_s4.php'. Validar y limpiar las entradas del usuario es crucial para prevenir ataques XSS.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-4577 is a cross-site scripting (XSS) vulnerability in Exam Form Submission 1.0, allowing attackers to inject malicious scripts via the 'sname' parameter in /admin/update_s4.php.
If you are using Exam Form Submission version 1.0 and have not applied a patch, you are potentially affected by this XSS vulnerability.
Upgrade to a patched version of Exam Form Submission. If a patch is unavailable, implement strict input validation and output encoding on the 'sname' parameter and consider a WAF.
A public exploit exists, indicating a potential for active exploitation. Prompt mitigation is recommended.
Refer to the code-projects repository and associated security advisories for updates and information regarding CVE-2026-4577.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.