CVE-2026-86238— projectworlds Online Examination System Feedback Form feedback.php cross site scripting
Quick assessment
Affected
projectworlds Online Examination System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ProjectWorlds 在线考试系统 1.0 中发现了一个漏洞。受影响的组件是反馈表单（Feedback Form）中 feedback.php 文件的一个未知函数。攻击者可以通过操控 Name 或 Subject 参数触发跨站脚本（XSS）漏洞。该攻击可远程发起。此漏洞的利用方式已公开披露，并已被实际利用。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86238
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
projectworlds Online Examination System Feedback Form feedback.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| projectworlds | Online Examination System | 1.0 |
cpe:2.3:a:projectworlds:online_examination_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-86238
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86238
请登录查看更多情报信息。
Proof of Concept for CVE-2026-86238 (1)
Other References for CVE-2026-86238 (3)
-
🔗 CVE-2026-86238 in Online Examination System third-party-advisory
-
-
IV. Related Vulnerabilities
Same product: Online Examination System
-
CVE-2026-16220
code-projects Online Examination System account.php cross si -
CVE-2026-2173
code-projects Online Examination System login.php sql inject -
CVE-2026-1423
code-projects Online Examination System admin_pic.php unrest -
CVE-2026-1422
code-projects Online Examination System Login Page index.php -
CVE-2026-1421
code-projects Online Examination System Add Pages cross site
Same vendor: projectworlds
-
CVE-2026-10875
projectworlds Online Art Gallery Shop Project adminHome.ph s -
CVE-2026-10874
projectworlds Online Art Gallery Shop Project adminHome.php -
CVE-2026-9364
projectworlds Online Art Gallery Shop adminHome.php sql inje -
CVE-2026-8785
projectworlds hospital-management-system-in-php GET Paramete -
CVE-2026-5645
projectworlds Car Rental System Parameter pay.php sql inject
Same weakness: CWE-79
-
CVE-2026-86264
sfturing ssm_pro Order Endpoint OrderController.java cross s -
CVE-2026-86244
FastAdmin User Controller User.php login cross site scriptin -
CVE-2026-86226
Projectwolds Online Attendance System profile.php cross site -
CVE-2026-86216
code-projects Hotel and Tourism Reservation in PHP details.p -
CVE-2026-86181
code-projects Task Management System User Profile Update Upd
V. Comments for CVE-2026-86238
No comments yet