CVE-2026-13504: Project Management System XSS Vulnerability

CVE-2026-13504 Overview

CVE-2026-13504 is a cross-site scripting (XSS) vulnerability affecting code-projects Project Management System 1.0. The flaw resides in the /mail.php script, which implements the Mail Compose Page component. Attackers can inject malicious script content that executes in the browser of any user who processes the crafted input. The vulnerability is exploitable over the network and requires low-privileged authenticated access along with user interaction. Public disclosure of the exploit has occurred, increasing the likelihood of opportunistic abuse against exposed installations. The weakness is tracked under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
Authenticated attackers can inject persistent or reflected scripts through the Mail Compose Page, enabling session token theft, credential capture, and unauthorized actions performed in the victim's browser context.

Affected Products

code-projects Project Management System 1.0
Component: Mail Compose Page (/mail.php)
Deployments exposing the application to untrusted authenticated users

Discovery Timeline

2026-06-28 - CVE-2026-13504 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13504

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the Mail Compose Page of code-projects Project Management System 1.0. The /mail.php endpoint accepts user-supplied input without adequately neutralizing HTML and JavaScript control characters. When that input is later rendered in the application interface, the browser interprets the injected payload as executable script. Exploitation requires a low-privileged account and user interaction, such as viewing a composed mail entry. The public availability of exploitation details makes the flaw accessible to less sophisticated adversaries.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Parameters submitted to /mail.php are echoed into the response body without contextual encoding or sanitization. Neither server-side filtering nor a Content Security Policy prevents inline JavaScript execution. Because the Mail Compose Page is designed to accept rich text content, developers appear to have prioritized formatting flexibility over output escaping.

Attack Vector

An authenticated attacker submits a crafted payload through a Mail Compose Page input field. The payload persists or reflects into the rendered HTML output. When a legitimate user opens the affected view, the injected script executes with the victim's session context. Attackers can steal session cookies, pivot to internal actions, deliver phishing overlays, or redirect users to attacker-controlled infrastructure. The exploit has been publicly disclosed through VulDB CVE-2026-13504 and the GitHub CVE Submission Guide.

No verified proof-of-concept code is included in this advisory. See the VulDB Vulnerability #374499 entry for technical disclosure details.

Detection Methods for CVE-2026-13504

Indicators of Compromise

HTTP POST or GET requests to /mail.php containing encoded <script>, onerror=, onload=, or javascript: payloads
Outbound requests from user browsers to unknown domains shortly after accessing the Mail Compose Page
Unexpected creation of session tokens or password resets originating from valid user accounts
Web server logs showing HTML entities such as %3Cscript%3E in request parameters targeting /mail.php

Detection Strategies

Deploy a web application firewall rule set that inspects requests to /mail.php for script tags, event handlers, and encoded XSS patterns
Enable verbose access logging on the application server and alert on anomalous parameter lengths or suspicious character sequences
Correlate authentication events with subsequent Mail Compose Page activity to identify anomalous posting behavior

Monitoring Recommendations

Continuously monitor HTTP request bodies for XSS payload signatures using intrusion detection systems
Track referer headers and DOM events to identify browser-side execution of injected content
Review browser Content Security Policy violation reports if CSP is enforced in reporting mode

How to Mitigate CVE-2026-13504

Immediate Actions Required

Restrict access to the Project Management System to trusted internal networks or VPN users until a patched release is available
Revoke and rotate active session tokens for all users, particularly administrators
Disable or place the Mail Compose Page behind additional authentication controls if the feature is not business critical
Audit user accounts and logs for evidence of exploitation attempts against /mail.php

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Refer to the Code Projects Resource Hub for updated releases. Organizations should track the VulDB CVE-2026-13504 entry for remediation guidance.

Workarounds

Deploy a reverse proxy or WAF rule that strips or blocks HTML control characters in parameters submitted to /mail.php
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Apply server-side output encoding by wrapping user-controlled fields with HTML entity escaping functions before rendering

bash

# Example nginx rule to block common XSS payloads targeting /mail.php
location /mail.php {
    if ($args ~* "(<|%3C)script|onerror=|onload=|javascript:") {
        return 403;
    }
    proxy_pass http://backend;
}