CVE-2026-2224 Details

A cross-site scripting (XSS) vulnerability has been identified in Code-Projects Online Reviewer System version 1.0. The issue resides in the file '/system/system/admins/manage/users/btn_functions.php', where the 'firstname' parameter is not properly sanitized before being output. This flaw allows remote attackers to inject and execute malicious scripts in the context of the user's session, potentially leading to session hijacking, unauthorized actions, phishing attacks, website defacement, and redirection to malicious sites.

It is recommended to implement context-aware output encoding for all user-supplied data before rendering it in the HTML response. Additionally, input validation should be applied to ensure that only expected characters and formats are accepted. Consider using a Content Security Policy (CSP) to restrict the sources from which scripts can be loaded and executed. Finally, mark sensitive cookies with the 'HttpOnly' and 'Secure' flags to protect against session hijacking.