The vulnerability CVE-2026-14658 affects code-projects Assessment Management 1.0. It is caused by improper sanitization of the smarksrange[] argument in the /lecturer/marking-scheme.php script, leading to SQL injection. This allows remote attackers to manipulate backend database queries by injecting malicious SQL code. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. The exploit is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Assessment Management system. This may lead to unauthorized data access, data modification, or other database impacts depending on the database permissions. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the smarksrange[] parameter. Restricting database permissions to the minimum necessary may also reduce impact.