CVE-2026-14655: Assessment Management 1.0 XSS Vulnerability

CVE-2026-14655 Overview

CVE-2026-14655 is a cross-site scripting (XSS) vulnerability [CWE-79] in code-projects Assessment Management 1.0. The flaw resides in the admin/view-users.php file, where the User argument is not properly sanitized before being rendered. A remote attacker with high privileges can inject arbitrary JavaScript that executes in the browser of any user viewing the affected page. The exploit is publicly available, which increases the likelihood of opportunistic abuse against exposed installations.

Critical Impact

Authenticated attackers can inject persistent JavaScript into the administrative user view, enabling session theft, credential harvesting, and pivoting to further administrative actions within the Assessment Management application.

Affected Products

• code-projects Assessment Management 1.0
• Component: admin/view-users.php
• Vulnerable parameter: User

Discovery Timeline

• 2026-07-04 - CVE-2026-14655 published to NVD
• 2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14655

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the administrative user-listing page of code-projects Assessment Management 1.0. The admin/view-users.php script accepts a User parameter and echoes it back into the HTML response without applying output encoding or contextual sanitization. An attacker who can submit crafted input, either directly or through a social-engineered link, causes browser execution of the injected payload within the trust context of the application. Because the attack vector is network-based and the affected surface is an administrative interface, successful exploitation grants access to session material and interface actions available to the targeted account.

Root Cause

The root cause is missing input validation and output encoding on the User request parameter processed by admin/view-users.php. User-controlled data flows directly into the HTML response, satisfying the classic pattern documented under [CWE-79]. No context-aware escaping (HTML entity, JavaScript string, or attribute encoding) is applied before rendering.

Attack Vector

Exploitation requires network access to the application and a target user willing to interact with a crafted link (user interaction is required per the CVSS vector). The attacker supplies a malicious payload in the User argument. When the administrator loads the resulting URL, the browser parses and executes the injected script. A public proof of concept is documented in the GitHub CVE Assessment and referenced by VulDB CVE #CVE-2026-14655.

No verified exploit code is reproduced here. Refer to the linked advisory for technical proof-of-concept details.

Detection Methods for CVE-2026-14655

Indicators of Compromise

• HTTP requests to admin/view-users.php containing <script>, javascript:, onerror=, or URL-encoded equivalents in the User parameter.
• Web server access logs showing unusually long or encoded values for the User query string parameter.
• Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting view-users.php.

Detection Strategies

• Deploy a web application firewall (WAF) rule that flags reflected XSS payload patterns targeting the User parameter on admin/view-users.php.
• Enable server-side logging of full query strings and review for HTML or JavaScript syntax within the User argument.
• Correlate administrator authentication events with subsequent anomalous outbound requests from the same browser session.

Monitoring Recommendations

• Monitor admin/view-users.php request patterns for encoded angle brackets (%3C, %3E) and event handler attributes.
• Alert on repeated 200-response requests to the admin path from non-administrative source networks.
• Track Content Security Policy (CSP) violation reports if CSP is enforced on administrative pages.

How to Mitigate CVE-2026-14655

Immediate Actions Required

• Restrict access to admin/view-users.php to trusted administrative IP ranges using web server ACLs or a reverse proxy.
• Instruct administrators to avoid clicking untrusted links that reference the Assessment Management application.
• Deploy a WAF signature blocking script tags and JavaScript event handlers in the User parameter.

Patch Information

No official vendor patch has been published for CVE-2026-14655 at the time of writing. Consult the Code Projects Resource and VulDB Vulnerability #376169 pages for update notices.

Workarounds

• Apply server-side output encoding for the User variable in admin/view-users.php using htmlspecialchars($user, ENT_QUOTES, 'UTF-8') before echoing.
• Enforce a strict Content Security Policy on administrative pages to block inline script execution.
• Require re-authentication for sensitive administrative actions to limit the value of a hijacked session.

# Example: enforce CSP header at the web server layer (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"