CVE-2026-16220 in Online Examination System
Summary
by MITRE • 07/19/2026
A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the code-projects Online Examination System 1.0 represents a critical cross-site scripting flaw that resides within the account.php file at the /account.php?q=quiz endpoint. This weakness specifically manifests when manipulating the eid/n/t arguments, creating an avenue for malicious actors to inject and execute arbitrary JavaScript code within the context of a victim's browser session. The vulnerability's remote exploitation capability means that attackers can launch attacks without requiring physical access to the target system or network, making it particularly dangerous in web-based environments where users interact with the application through standard web browsers.
The technical implementation of this XSS vulnerability stems from insufficient input validation and output encoding mechanisms within the application's parameter handling logic. When the application processes the eid/n/t arguments passed through the query string without proper sanitization, it fails to escape or encode special characters that could be interpreted as HTML or JavaScript markup. This lack of proper input filtering creates a direct pathway for attackers to inject malicious payloads that persistently execute in the victim's browser context, potentially capturing session cookies, redirecting users to malicious sites, or performing unauthorized actions on behalf of authenticated users.
The operational impact of this vulnerability extends beyond simple script execution as it fundamentally compromises the security posture of the entire examination system. Authentication tokens and user session data could be stolen through session hijacking techniques, while the persistent nature of stored XSS attacks allows attackers to maintain long-term access to compromised accounts. Given that this is an online examination system, the implications are particularly severe as it may lead to unauthorized access to exam content, manipulation of test results, or complete disruption of academic assessment processes. The vulnerability affects not only individual user sessions but could potentially compromise entire institutional databases and academic integrity frameworks.
Security professionals should consider this vulnerability as a prime candidate for exploitation under the MITRE ATT&CK framework, specifically mapping to techniques involving code injection and credential access. The presence of a publicly disclosed exploit significantly elevates the risk level, as it removes the need for sophisticated attack development and allows any malicious actor to leverage this weakness effectively. Organizations should immediately implement input validation controls at the application layer, including proper HTML escaping and sanitization of all user-supplied parameters. Additionally, implementing Content Security Policy headers and using secure coding practices such as parameterized queries and input whitelisting can provide defense-in-depth measures against similar vulnerabilities. Regular security assessments and penetration testing should be conducted to identify and remediate other potential entry points within the application's attack surface, particularly focusing on parameter handling and user input validation mechanisms that could similarly expose the system to cross-site scripting attacks.