CVE-2026-93976: Assessment Management 1.0 XSS Vulnerability

CVE-2026-93976 Overview

CVE-2026-93976 is a cross-site scripting (XSS) vulnerability affecting code-projects Assessment Management 1.0. The flaw resides in an unknown function within the admin/add-user.php file. Attackers can manipulate the level parameter to inject arbitrary script content that executes in the context of an authenticated administrator's browser session. The issue is classified under [CWE-79] and is exploitable remotely over the network. Public exploit details have been disclosed, lowering the barrier for opportunistic abuse. Successful exploitation requires high privileges and user interaction, which limits impact but still allows attackers to influence rendered content in administrative interfaces.

Critical Impact
Authenticated attackers can inject JavaScript through the level parameter of admin/add-user.php, enabling session-context script execution within the admin panel.

Affected Products

code-projects Assessment Management 1.0
Component: admin/add-user.php
Vulnerable parameter: level

Discovery Timeline

2026-09-20 - CVE-2026-93976 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93976

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the administrative user management workflow of Assessment Management 1.0. The admin/add-user.php endpoint accepts a level argument that is rendered back to the browser without proper output encoding or input sanitization. An attacker with administrative access can submit crafted payloads containing HTML or JavaScript in the level field. When the affected page is loaded, the browser interprets the injected content as executable script. The disclosed exploit path is public, and the attack requires user interaction to trigger rendering.

Root Cause

The root cause is missing input validation and output encoding on the level parameter processed by admin/add-user.php. User-controlled data is written into the HTML response context without escaping characters such as <, >, and ". This allows arbitrary markup to be introduced into the DOM. The weakness aligns with [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the admin interface and valid high-privilege credentials. The attacker submits a malicious payload through the level argument. When the injected content is rendered, the payload executes in the victim's browser under the origin of the vulnerable application. Refer to the GitHub CVE Documentation and the VulDB CVE Report for further technical description.

Detection Methods for CVE-2026-93976

Indicators of Compromise

HTTP POST or GET requests to admin/add-user.php containing <script>, onerror=, onload=, or encoded variants within the level parameter.
Unexpected JavaScript execution or DOM changes observed on administrative pages that render the level value.
Web server access logs showing repeated requests to add-user.php from a single source with abnormal parameter payloads.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the level parameter for HTML tags, JavaScript event handlers, and URL-encoded script payloads.
Enable full HTTP request body logging for the admin/ directory and alert on non-alphanumeric input in the level field.
Review browser Content Security Policy (CSP) violation reports for inline script execution originating from admin pages.

Monitoring Recommendations

Monitor administrator session activity for anomalous actions initiated shortly after visiting the user management pages.
Track outbound requests from administrator browsers to unknown domains, which may indicate exfiltration via injected scripts.
Correlate authentication logs with requests to add-user.php to identify unusual admin behavior.

How to Mitigate CVE-2026-93976

Immediate Actions Required

Restrict access to the admin/ directory using IP allowlisting or reverse-proxy authentication until a fix is available.
Rotate administrative credentials and review recent user account creations for unauthorized additions.
Deploy WAF rules to block script tags and JavaScript event handlers submitted through the level parameter.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Code Projects Resource Hub for updates and monitor the VulDB Vulnerability Details page for remediation guidance.

Workarounds

Apply server-side input validation to reject non-numeric or non-enumerated values for the level parameter before processing.
Implement output encoding using functions such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8') when rendering user-supplied data.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Example nginx configuration snippet to add CSP and block suspicious payloads
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
location ~* /admin/add-user\.php {
    if ($arg_level ~* "(<|>|script|onerror|onload)") {
        return 403;
    }
}