Live › vulnerability › CVE-2026-116097
Go to dashboardThe addnewstudent.php page in CloudClassroom-PHP-Project does not sanitize the fname argument, so attacker-supplied input is reflected into the page. A remote attacker can run script in the browser of a user who opens a crafted link or submission.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 00:38 UTC. All times on this page are UTC.
Only installations of CloudClassroom-PHP-Project that expose addnewstudent.php are exposed. The project is a rolling release with no version information, so the sources give no version to compare against. Teams that do not run this project can skip it.
No product ranges from the sources yet.
addnewstudent.php and check whether fname is echoed into output without escaping (for example with htmlspecialchars)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.