Vulnerability · Published Apr 28, 2026 · Assigned by VulDB
CVE-2026-7222code-projects Coaching Management System Complaint Form complaint.php cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Coaching Management System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/modules/student/complaint.php of the component Complaint Form Page. This manipulation of the argument Complaint causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Coaching Management System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-359822 | code-projects Coaching Management System Complaint Form complaint.php cross site scripting vdb-entry, technical-description
- VDB-359822 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #802264 | code-projects Coaching Management System in PHP Unknown Cross Site Scripting third-party-advisory
- https://github.com/Xmyronn/Stored-Cross-Site-Scripting-XSS-in-Coaching-Management-System.git exploit
- https://code-projects.org/ product