{"id":"CVE-2026-116097","kind":"vulnerability","aliases":["CVE-2026-116097"],"related":[],"title":"CloudClassroom-PHP-Project: addnewstudent.php fname parameter enables cross-site scripting","description":"A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The addnewstudent.php page in CloudClassroom-PHP-Project does not sanitize the fname argument, so attacker-supplied input is reflected into the page. A remote attacker can run script in the browser of a user who opens a crafted link or submission.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudclassroom-php-project","package","php","self-hosted"],"not_affected_if":["not-deployed"],"how_to_check":"- Search the codebase for `addnewstudent.php` and check whether `fname` is echoed into output without escaping (for example with `htmlspecialchars`)\n- Confirm whether the deployed copy of the project is publicly reachable","fix":null,"status":"open","published_at":"2026-10-26T00:17:14+00:00","first_seen_at":"2026-10-26T00:38:41+00:00","triaged_at":"2026-10-26T00:40:31+00:00","updated_at":"2026-10-26T00:40:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T00:40:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudClassroom-PHP-Project: addnewstudent.php fname parameter enables cross-site scripting","impact":"medium","summary":"The addnewstudent.php page in CloudClassroom-PHP-Project does not sanitize the fname argument, so attacker-supplied input is reflected into the page. A remote attacker can run script in the browser of a user who opens a crafted link or submission.","category":"package","nicknames":[],"who_cares":["php","cloudclassroom-php-project","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in a logged-in user's browser session","analyst_note":"Confirm the fix state in the upstream repository and whether a patched commit exists; the sources report no vendor response.","how_to_check":"- Search the codebase for `addnewstudent.php` and check whether `fname` is echoed into output without escaping (for example with `htmlspecialchars`)\n- Confirm whether the deployed copy of the project is publicly reachable","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Only installations of CloudClassroom-PHP-Project that expose addnewstudent.php are exposed. The project is a rolling release with no version information, so the sources give no version to compare against. Teams that do not run this project can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3372,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116097':15A,18A '-2026':14A,17A 'addnewstudent.php':5A,29B,90C 'affect':83C,137C 'argument':41B,95C 'attack':44B,54B,103C 'attacker-suppli':43B 'basi':125C 'browser':60B 'cloudclassroom':2A,20B,33B,79C 'cloudclassroom-php-project':1A,19B,32B,78C 'consequ':129C 'contact':144C 'continu':127C 'craft':67B 'cross':10A,99C 'cross-sit':9A 'cve':13A,16A 'deliveri':128C 'detail':134C 'detect':76C 'disclos':112C 'disclosur':148C 'earli':145C 'either':136C 'enabl':8A 'ensur':126C 'exploit':109C 'file':89C 'fname':6A,40B,96C 'host':27B 'input':46B 'launch':106C 'lead':97C 'link':68B 'manipul':92C 'may':104C,115C 'open':65B 'oper':120C 'packag':23B 'page':30B,51B 'paramet':7A 'part':86C 'php':3A,21B,24B,34B,80C 'product':119C 'project':4A,22B,35B,81C 'public':113C 'reflect':48B 'releas':124C,140C 'remot':53B,107C 'respond':152C 'roll':123C 'run':56B 'sanit':38B 'script':12A,57B,101C 'secur':72C 'self':26B 'self-host':25B 'site':11A,100C 'submiss':70B 'suppli':45B 'unknown':85C 'updat':139C 'use':117C 'user':63B 'vendor':142C 'version':133C 'vulner':73C 'way':155C","nicknames":[],"mitigations":[],"who_affected":"Only installations of CloudClassroom-PHP-Project that expose addnewstudent.php are exposed. The project is a rolling release with no version information, so the sources give no version to compare against. Teams that do not run this project can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116097","severity":null,"published_at":"2026-10-26T00:17:14+00:00","modified_at":"2026-10-26T00:17:14+00:00","first_seen_at":"2026-10-26T00:38:41+00:00","fetched_at":"2026-10-26T00:38:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}