CVE-2026-1421

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-142104.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 t CVE-2026-142113.8The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is r CVE-2026-142124.7The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns CVE-2026-142133.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is CVE-2026-142142.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its cu CVE-2026-142156.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token bef CVE-2026-142166.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pendin CVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, rely CVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actio CVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowi