CVE-2026-86238 in Online Examination System
Summary
by MITRE • 09/07/2026
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in ProjectWorlds Online Examination System version 1.0 represents a significant security risk within its feedback management infrastructure, specifically targeting the feedback.php component responsible for processing user input via the Feedback Form interface. This flaw is classified as an injection-based weakness where the application fails to adequately sanitize or validate data provided by users before it is processed and subsequently rendered back in the browser context. The specific point of failure lies in how the system handles the Name and Subject arguments submitted through this form, allowing malicious actors to inject executable script code that bypasses standard security controls such as input filtering and output encoding mechanisms.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The core issue stems from the application's failure to distinguish between trusted data and untrusted user input when rendering HTML content. When a victim interacts with the compromised feedback form, the injected script is not escaped but instead executed directly by the web browser interpreting the page. This execution occurs in the context of the authenticated session or the general website environment, granting the attacker the ability to run arbitrary JavaScript code within the domain of the vulnerable application without requiring any special privileges on the server side.
The operational impact of this vulnerability is severe due to its remote exploitability and public disclosure status. Attackers can launch cross-site scripting attacks remotely by crafting a malicious URL or embedding the payload in another website, then tricking users into visiting it through social engineering tactics such as phishing emails or compromised links. Once executed, the script can perform various harmful actions including stealing session cookies to hijack user accounts, redirecting victims to malicious sites designed for further exploitation, defacing the web application's appearance, or harvesting sensitive information entered by other users on subsequent pages within the same domain. Because the exploit is publicly disclosed and actively utilized in the wild, systems running this version are at immediate risk of compromise without additional protective measures.
Mitigation strategies must address both the root cause and potential attack vectors to secure the environment effectively. The primary remediation involves implementing strict input validation and output encoding on the server side for all user-supplied data, particularly within the feedback.php file's handling of Name and Subject fields. Developers should ensure that special characters are encoded using appropriate HTML entity encoding before rendering them in the browser context. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking known XSS payloads based on signature-based detection rules. Organizations currently running this version should prioritize upgrading to a patched release if available or apply manual code fixes to neutralize the input handling logic until such updates are deployed.