CVE-2026-13504: XSS Vulnerability in code-projects Project Management System 1.0 Mail Compose Page

Technical summary

CVE-2026-13504 is a reflected or stored XSS flaw in the /mail.php component of code-projects PMS 1.0, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). The vulnerability stems from insufficient input sanitization in the Mail Compose Page handler. Attack surface is limited by authentication requirements (PR:L in the CVSS vector), but the lack of user interaction barriers in certain contexts may broaden impact. No remote, unauthenticated exploitation path exists under standard deployment.

Business impact

An internal attacker or compromised legitimate user account can craft malicious email messages that execute JavaScript in recipients' browsers. Potential impacts include session hijacking, credential theft, unauthorized actions taken on behalf of the victim, or defacement of the mail interface. Since mail systems often contain sensitive project data, this escalates beyond typical XSS scope. Risk is primarily insider-focused but should not be dismissed if user accounts are frequently compromised or if external users can register with the system.

Affected systems

code-projects Project Management System version 1.0 is confirmed vulnerable. Organizations running this version in production should audit their deployment scope. Newer versions may have addressed this issue; consult the vendor's security advisory for definitive patch status. No widespread adoption metrics are available from this source.

Exploitability

The CVSS score of 3.5 (LOW severity) reflects a deliberately constrained attack scenario: authentication is required, and the attack vector depends on user interaction (clicking a malicious link or opening a crafted email). However, public disclosure means proof-of-concept code is available, lowering the barrier to weaponization. An attacker with valid credentials or access to a compromised account can immediately attempt exploitation without reverse-engineering.

Remediation

Verify whether vendor patches exist for code-projects PMS 1.0 by consulting the official vendor security advisories or product documentation. If patching is not available, consider implementing a Web Application Firewall (WAF) with XSS filtering rules targeting the /mail.php endpoint, enforcing Content Security Policy (CSP) headers to restrict inline script execution, and disabling HTML composition features in the mail client if plain-text alternatives are viable. Additionally, apply principle of least privilege to mail system access and conduct user training on phishing and social engineering tactics.

Patch guidance

Check the code-projects vendor website or contact their support for available security updates to version 1.0. If updates are not offered, evaluate migration to a maintained, patched version or alternative project management platform. Test any patches in a staging environment before production deployment. Verify that the patched version correctly sanitizes user input in the Mail Compose Page without breaking legitimate email formatting features.

Detection guidance

Monitor application logs for suspicious activity in /mail.php, including unusual character sequences (script tags, event handlers, encoded payloads) in mail composition submissions. Use a WAF or intrusion detection system (IDS) to flag requests containing common XSS patterns (e.g., <script>, onerror=, javascript:). Review email audit logs to identify messages with embedded JavaScript or suspicious formatting. Correlate spikes in XSS-pattern detections with specific user accounts to identify compromised credentials.

Why prioritize this

Although the CVSS base score is LOW (3.5), this vulnerability should not be neglected. Public disclosure accelerates malicious adoption, and the Mail Compose Page is a high-value target due to proximity to sensitive project communications. Organizations with strict data governance or regulatory compliance (e.g., financial, healthcare) should elevate priority. However, if the system is isolated to trusted internal networks with strong identity controls, it may be safely deferred pending vendor patch availability.

Risk score, explained

The CVSS 3.1 score of 3.5 reflects a low-severity XSS with authentication barriers and user-interaction requirements. The vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) indicates network-accessible but login-restricted, low attack complexity, required user interaction, no scope expansion, low integrity impact, and no confidentiality or availability impact. This scoring assumes an attacker does not have a high-value position within the organization; real-world context may justify higher prioritization for systems where user trust relationships are exploitable or where the mail system is internet-facing.

Frequently asked questions