CVE-2026-86238: projectworlds Online Examination System Feedback Form feedback.php cross site scripting
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely and does not require privileges, but it requires user interaction. An attacker would manipulate the Name or Subject argument submitted through the Feedback Form in feedback.php.
Which deployments are affected?
The affected product identified in the available data is projectworlds Online Examination System 1.0. The vulnerable component is the Feedback Form, specifically feedback.php.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.