CVE-2026-86238: Cross Site Scripting in projectworlds Online Examination System

The projectworlds Online Examination System 1.0 contains a cross-site scripting vulnerability in the feedback.php file's Feedback Form component. Specifically, manipulation of the Name or Subject arguments can lead to XSS attacks. This vulnerability can be exploited remotely without privileges or user interaction beyond triggering the vulnerable input. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the feedback form. This could lead to session hijacking, defacement, or other client-side impacts. There is no indication of direct impact on server integrity or availability. The vulnerability is exploitable remotely and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. In the meantime, consider applying input validation or sanitization on the Name and Subject fields to mitigate XSS risks.