CVE-2026-86238: Online Examination System XSS Vulnerability

CVE-2026-86238 Overview

CVE-2026-86238 is a reflected cross-site scripting (XSS) vulnerability in projectworlds Online Examination System 1.0. The flaw resides in the feedback.php file within the Feedback Form component. Attackers can manipulate the Name or Subject parameters to inject arbitrary JavaScript into responses rendered to users.

The vulnerability is exploitable remotely and requires user interaction. A public exploit disclosure has been made, increasing the likelihood of opportunistic scanning and abuse. The weakness maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables attackers to execute arbitrary script in a victim's browser session, potentially leading to session hijacking, credential theft, or defacement of the feedback interface.

Affected Products

projectworlds Online Examination System 1.0
Component: Feedback Form (feedback.php)
Affected parameters: Name and Subject

Discovery Timeline

2026-09-07 - CVE-2026-86238 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86238

Vulnerability Analysis

The vulnerability exists in the feedback.php script of the Feedback Form component. User-supplied values for the Name and Subject fields are not properly sanitized or encoded before being reflected in the HTTP response. This allows an attacker to inject arbitrary HTML or JavaScript payloads.

Because the application processes the input server-side and returns it to the browser without contextual output encoding, malicious script tags execute in the context of the victim's session. The attack requires user interaction, meaning the victim must click a crafted link or submit a poisoned form.

Root Cause

The root cause is missing input validation and output encoding on parameters accepted by feedback.php. The application trusts client-supplied data and renders it directly into the HTML response body. This is a textbook [CWE-79] failure common to legacy PHP applications lacking a templating layer with automatic escaping.

Attack Vector

An attacker crafts a URL or form submission containing a malicious payload in the Name or Subject argument. When the victim submits or visits the crafted request, the injected script executes in their browser under the origin of the vulnerable application. The exploit has been publicly disclosed through VulDB, and no authentication is required to trigger the flaw.

Refer to the VulDB CVE-2026-86238 advisory and the project repository for additional technical context. No verified proof-of-concept code is included here.

Detection Methods for CVE-2026-86238

Indicators of Compromise

HTTP requests to feedback.php containing script tags, event handlers (onerror, onload), or JavaScript URI schemes in the Name or Subject parameters.
Reflected responses from feedback.php containing unescaped <script> or <img> tags matching request input.
Unusual outbound requests from user browsers to attacker-controlled domains shortly after accessing the feedback page.

Detection Strategies

Deploy a web application firewall (WAF) rule to inspect POST and GET requests to feedback.php for XSS payload signatures.
Enable server-side request logging for the Feedback Form and alert on payloads containing HTML control characters (<, >, ", ') in the Name or Subject fields.
Perform automated dynamic application security testing (DAST) against the feedback endpoint to confirm exposure.

Monitoring Recommendations

Monitor web server access logs for anomalous query strings targeting feedback.php.
Track Content Security Policy (CSP) violation reports to identify blocked script injection attempts.
Correlate feedback-form submissions with session token theft events or unusual authentication activity.

How to Mitigate CVE-2026-86238

Immediate Actions Required

Restrict or disable public access to feedback.php until a fix is applied.
Apply server-side input validation on the Name and Subject parameters, rejecting HTML control characters.
Deploy a WAF ruleset that blocks common XSS payload patterns targeting the Feedback Form.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted origins.

Patch Information

No vendor patch has been referenced in the public advisories at the time of publication. Administrators should monitor the project repository for updates and consult the VulDB entry for remediation status. Where feasible, replace the affected component with a modern framework that provides automatic output escaping.

Workarounds

Sanitize input server-side using PHP functions such as htmlspecialchars() with ENT_QUOTES before rendering the Name and Subject values.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft.
Implement a Content Security Policy header that blocks inline JavaScript execution.
Isolate the application behind authentication or an IP allowlist if the deployment is non-public.

bash

# Example Content Security Policy header for Apache/Nginx
# Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"

# Nginx (server block)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;