Medium severity · published Mar 30, 2026
CVE-2026-5106
code-projects Exam Form Submission update_fst.php cross site scripting
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Exam Form Submission · code-projects
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5106
Product
https://code-projects.org/
Permissions Required
https://github.com/sxc2044-pixel/hajimi/issues/1
Third Party Advisory
https://vuldb.com/submit/780091
Third Party Advisory
https://vuldb.com/vuln/354131
Third Party Advisory
https://vuldb.com/vuln/354131/cti
More from Exam Form Submission
9.8
CVE-2025-8372
code-projects Exam Form Submission update_s7.php sql injection
9.8
CVE-2025-8371
code-projects Exam Form Submission update_s5.php sql injection
9.8
CVE-2025-8328
code-projects Exam Form Submission register.php sql injection
9.8
CVE-2025-8327
code-projects Exam Form Submission delete_s8.php sql injection
9.8
CVE-2025-8326
code-projects Exam Form Submission delete_s7.php sql injection