CVE-2026-4973— SourceCodester Online Quiz System add-question.php cross site scripting
Quick assessment
Affected
SourceCodester Online Quiz System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SourceCodester Online Quiz System是SourceCodester开源的一个在线问答系统。 SourceCodester Online Quiz System 1.0及之前版本存在安全漏洞，该漏洞源于对文件endpoint/add-question.php中参数quiz_question的错误操作，可能导致跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-4973
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Online Quiz System add-question.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-question.php. Performing a manipulation of the argument quiz_question results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SourceCodester Online Quiz System 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SourceCodester Online Quiz System是SourceCodester开源的一个在线问答系统。 SourceCodester Online Quiz System 1.0及之前版本存在安全漏洞，该漏洞源于对文件endpoint/add-question.php中参数quiz_question的错误操作，可能导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Online Quiz System | 1.0 | - |
|
II. Public POCs for CVE-2026-4973
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4973
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-4973 (2)
-
Submit #778101: SourceCodester Online Quiz System 1.0 Cross Site Scripting third-party-advisory
-
CVE-2026-4973 SourceCodester Online Quiz System add-question.php cross site scripting vdb-entry technical-description
Proof of Concept for CVE-2026-4973 (1)
Other References for CVE-2026-4973 (1)
Same Patch Batch · SourceCodester · 2026-03-27 · 3 CVEs total
| CVE-2026-4968 | 4.3 MEDIUM | SourceCodester Diary App diary.php cross-site request forgery |
| CVE-2026-4971 | 4.3 MEDIUM | SourceCodester Note Taking App cross-site request forgery |
IV. Related Vulnerabilities
Same vendor: SourceCodester
-
CVE-2026-104612
SourceCodester Student Result Management System Announcement -
CVE-2026-104123
SourceCodester Online Reviewer Management System btn_functio -
CVE-2026-102913
SourceCodester Car Driving School Management System Master.p -
CVE-2026-102912
SourceCodester Online Leave Management System page reports s -
CVE-2026-102910
SourceCodester Online Reviewer Management System exam-delete
Same weakness: CWE-79
-
CVE-2026-92243
Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scri -
CVE-2026-94378
SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored C -
CVE-2026-100180
Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cro -
CVE-2026-96270
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Sit -
CVE-2026-104479
Shopclass before 6.2.0 Stored XSS via Listing Description Fi
V. Comments for CVE-2026-4973
No comments yet