The vulnerability CVE-2026-14658 affects code-projects Assessment Management version 1.0. It is caused by improper sanitization of the smarksrange[] parameter in the /lecturer/marking-scheme.php file, leading to SQL injection. This allows an attacker with low privileges and no user interaction to remotely inject SQL commands. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The exploit code is publicly available. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated low for confidentiality, integrity, and availability, indicating limited but non-negligible risk. The vulnerability requires low privileges but no user interaction, making remote exploitation feasible.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to implement input validation or filtering on the smarksrange[] parameter to mitigate SQL injection risks and monitor for suspicious activity related to this endpoint.