CVE-2026-16220: Online Examination System XSS Vulnerability

CVE-2026-16220 Overview

CVE-2026-16220 is a reflected cross-site scripting (XSS) vulnerability in code-projects Online Examination System 1.0. The flaw resides in the /account.php?q=quiz endpoint, where the eid, n, and t parameters are rendered into the response without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when the link is opened. The exploit has been publicly disclosed and may be reused by opportunistic attackers. The weakness is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary script in the context of an authenticated user's session, enabling session token theft, credential harvesting through injected forms, and unauthorized actions inside the exam platform.

Affected Products

code-projects Online Examination System 1.0
Deployments exposing /account.php?q=quiz to untrusted networks
Instances that render the eid, n, or t parameters without sanitization

Discovery Timeline

2026-07-19 - CVE-2026-16220 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16220

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the quiz account view of code-projects Online Examination System 1.0. The /account.php?q=quiz handler accepts the eid, n, and t GET parameters and echoes their values into the HTML response without HTML entity encoding or context-aware escaping. An attacker who supplies script markup in any of these parameters causes the browser to parse and execute the payload as part of the trusted page.

Because the payload runs inside the same origin as the examination system, injected JavaScript can read session cookies that lack the HttpOnly flag, capture keystrokes, submit exam responses on behalf of the victim, or pivot to CSRF-style requests against administrative endpoints. The attack requires user interaction — the target must click or load the crafted link — but no authentication is needed to trigger delivery.

Root Cause

The root cause is missing input validation and missing output encoding on user-controlled query string parameters. The application concatenates the eid, n, and t values directly into HTML output. No allowlist filters, context-specific escaping routines (such as htmlspecialchars for HTML text nodes), or Content Security Policy directives are applied to constrain execution of inline script.

Attack Vector

Exploitation is remote and network-based. An attacker crafts a URL of the form /account.php?q=quiz&eid=<payload> where <payload> contains an HTML or JavaScript construct such as an <img> tag with an onerror handler. The attacker delivers the link through phishing email, chat, or an embedded third-party page. When a logged-in user opens the URL, the browser renders the reflected payload and executes it inside the examination system's origin. Technical proof-of-concept details are documented in the GitHub CVE Documentation and the VulDB entry for CVE-2026-16220.

Detection Methods for CVE-2026-16220

Indicators of Compromise

Web server access logs containing requests to /account.php?q=quiz with eid, n, or t parameters holding HTML tags, script, onerror, onload, or URL-encoded angle brackets (%3C, %3E).
Referrer headers pointing to unfamiliar external domains preceding requests to the quiz endpoint.
Outbound requests from user browsers to attacker-controlled hosts shortly after visiting /account.php?q=quiz.
Session cookie reuse from unexpected IP addresses following a quiz page interaction.

Detection Strategies

Deploy a web application firewall rule that inspects eid, n, and t parameter values for XSS signatures such as <script, javascript:, and event handler attributes.
Enable server-side request logging with full query string capture and alert on payloads matching XSS heuristics.
Instrument the browser using Content Security Policy report-only mode to surface inline script violations originating from the account page.

Monitoring Recommendations

Correlate authentication events with anomalous quiz page requests to detect session hijack attempts.
Track spikes in 200-response requests to /account.php originating from external referrers or shared short-link services.
Review browser console error telemetry from managed endpoints for unexpected script execution on the examination domain.

How to Mitigate CVE-2026-16220

Immediate Actions Required

Restrict access to /account.php?q=quiz behind authenticated sessions and, where possible, network-level access controls until a fix is deployed.
Deploy WAF signatures that block requests containing script markup in the eid, n, or t parameters.
Rotate any session identifiers and credentials that may have been exposed through recent quiz page traffic.
Notify users of the phishing risk and instruct them to avoid clicking untrusted links referencing the examination system.

Patch Information

No official vendor patch has been published for code-projects Online Examination System 1.0 at the time of NVD publication on 2026-07-19. Administrators should monitor the code-projects homepage and the VulDB advisory for CVE-2026-16220 for updates. In the absence of a vendor fix, apply the source-level mitigations described below.

Workarounds

Modify account.php to apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to the eid, n, and t values before rendering them into HTML.
Introduce server-side input validation that rejects any value for eid, n, and t that does not match an expected numeric or alphanumeric pattern.
Deploy a strict Content-Security-Policy header that disallows inline script execution and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script execution.

bash

# Example nginx snippet to add a restrictive Content-Security-Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;