CVE-2026-4972

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-49733.5A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-497382.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepa CVE-2026-49748.8A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of t CVE-2026-497406.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation o CVE-2026-497418.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition record CVE-2026-497427.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t CVE-2026-497437.8Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation obj CVE-2026-497447.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497457.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497467.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in cert CVE-2026-49758.8A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component P CVE-2026-497536.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint Mint allows attacker-controlle