---
id: "CVE-2026-116097"
kind: "vulnerability"
aliases: ["CVE-2026-116097"]
title: "CloudClassroom-PHP-Project: addnewstudent.php fname parameter enables cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudclassroom-php-project", "package", "php", "self-hosted"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-26T00:17:14+00:00"
first_seen_at: "2026-10-26T00:38:41+00:00"
updated_at: "2026-10-26T00:40:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116097", "first_seen_at": "2026-10-26T00:38:41+00:00"}]
---

# CloudClassroom-PHP-Project: addnewstudent.php fname parameter enables cross-site scripting

The addnewstudent.php page in CloudClassroom-PHP-Project does not sanitize the fname argument, so attacker-supplied input is reflected into the page. A remote attacker can run script in the browser of a user who opens a crafted link or submission.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Search the codebase for `addnewstudent.php` and check whether `fname` is echoed into output without escaping (for example with `htmlspecialchars`)
- Confirm whether the deployed copy of the project is publicly reachable

## Timeline

- 2026-10-26T00:38:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116097

## From the sources

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_