The vulnerability CVE-2026-4595 affects code-projects Exam Form Submission 1.0. It is a cross-site scripting (XSS) issue located in the /admin/update_s6.php file. An attacker can manipulate the 'sname' parameter to inject malicious scripts that execute in the context of a victim's browser. The attack vector is network-based with low attack complexity but requires user interaction and privileges. The CVSS 4.0 base score is 4.8, indicating medium severity. No official patch or vendor advisory is provided in the available data.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and privileges, which limits the attack scope. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable functionality and validate or sanitize input parameters such as 'sname' to mitigate XSS risks. Monitor vendor channels for updates or patches.