CVE-2026-93977: Assessment Management 1.0 XSS Vulnerability

CVE-2026-93977 Overview

CVE-2026-93977 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in code-projects Assessment Management 1.0. The flaw resides in lecturer/add-single-mark.php, where the mark parameter is rendered without proper output encoding. An authenticated attacker can inject arbitrary script content that executes in the browser of a targeted user. The exploit has been publicly disclosed, making opportunistic exploitation feasible against unpatched deployments.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a lecturer session, enabling session data theft, UI manipulation, and follow-on actions performed on behalf of the victim.

Affected Products

code-projects Assessment Management 1.0
Affected file: lecturer/add-single-mark.php
Vulnerable parameter: mark

Discovery Timeline

2026-09-20 - CVE-2026-93977 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93977

Vulnerability Analysis

The vulnerability affects the mark entry workflow used by lecturer accounts in Assessment Management 1.0. The mark argument submitted to lecturer/add-single-mark.php is reflected into the HTTP response without HTML entity encoding or contextual sanitization. As a result, script payloads supplied in that parameter execute in the victim's browser under the application's origin. The issue is remotely reachable over the network and requires user interaction, such as clicking a crafted link or loading a prepared form.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application accepts the mark value from the request and inserts it directly into the rendered HTML. No allow-list validation, output encoding, or Content Security Policy (CSP) enforcement mitigates the injection. Any character sequence forming a valid HTML or JavaScript construct passes through unchanged.

Attack Vector

An attacker with low-privilege credentials crafts a URL or form that submits a JavaScript payload in the mark parameter to lecturer/add-single-mark.php. The attacker lures an authenticated user into triggering the request. When the response renders, the payload executes in the victim's browser. Consult the GitHub CVE-2026-93977 Documentation and VulDB CVE-2026-93977 Details for the disclosed proof-of-concept request structure.

No verified code examples are available for this advisory; refer to the linked references for the disclosed request format.

Detection Methods for CVE-2026-93977

Indicators of Compromise

HTTP POST or GET requests to lecturer/add-single-mark.php containing <script>, onerror=, onload=, or URL-encoded equivalents in the mark parameter.
Web server access logs showing unusual referrers or repeated submissions to the mark-entry endpoint from a single source.
Browser console errors or unexpected outbound requests originating from lecturer session pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the mark parameter for HTML tags, event handlers, and JavaScript URI schemes.
Enable server-side request logging on lecturer/add-single-mark.php and alert on payloads containing script-like syntax.
Correlate authenticated lecturer sessions with outbound requests to unfamiliar domains that could indicate exfiltration by injected scripts.

Monitoring Recommendations

Monitor for anomalous session token usage originating from browsers that rendered the vulnerable page.
Track spikes in 200-OK responses from add-single-mark.php with abnormally large query strings or bodies.
Review browser telemetry, where available, for CSP violation reports on pages served by the Assessment Management application.

How to Mitigate CVE-2026-93977

Immediate Actions Required

Restrict access to lecturer/add-single-mark.php to trusted networks or VPN users until a fix is applied.
Apply server-side input filtering that rejects HTML metacharacters in the mark parameter.
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources.

Patch Information

No vendor patch is referenced in the published advisory. Monitor the Code Projects Resource Hub and the VulDB Vulnerability ID #407936 entry for updates. Until an official fix is released, apply the workarounds below and treat the application as exposed.

Workarounds

Add server-side output encoding (for example, htmlspecialchars($mark, ENT_QUOTES, 'UTF-8')) before rendering the mark value.
Deploy WAF signatures that block payloads matching <script, javascript:, and common event-handler attributes in the mark parameter.
Set HttpOnly and SameSite=Strict on session cookies to limit the impact of script execution.
Disable the lecturer mark-entry feature if it is not required in production.

bash

# Example Apache configuration to add security headers
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Header always set X-XSS-Protection "1; mode=block"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict