The vulnerability CVE-2026-14705 affects code-projects Online Examination 1.0. It involves an SQL injection flaw in the head.php file triggered by crafted input in the uname or password parameters. This allows an attacker to execute unauthorized SQL commands remotely without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and has been publicly disclosed. No official fix or patch has been published by the vendor as of the information provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. Since the attack vector is network-based and requires no privileges or user interaction, it poses a significant risk to affected systems. However, the CVSS vector indicates low to limited scope and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the uname and password parameters to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database permissions may also help reduce impact.