CVE-2026-14705 is a SQL injection vulnerability affecting code-projects Online Examination version 1.0. The flaw exists in the head.php file where manipulation of the uname and password parameters can lead to injection of malicious SQL code. This vulnerability can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but there is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, low complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to SQL injection attempts targeting uname and password parameters.