{"id":"CVE-2026-120339","kind":"vulnerability","aliases":["CVE-2026-120339"],"related":[],"title":"CloudClassroom-PHP-Project: XSS via fname parameter in updatedetailsfromfaculty.php","description":"A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A cross-site scripting flaw in the updatedetailsfromfaculty.php file of the CloudClassroom-PHP-Project lets an attacker manipulate the fname argument to inject script. An attacker can run script in the browser of a user who opens the crafted page, and the exploit has been published.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudclassroom-php-project","package","php","self-hosted"],"not_affected_if":["not-deployed","output-escaped"],"how_to_check":"- Look for updatedetailsfromfaculty.php in your CloudClassroom-PHP-Project deployment and check whether it echoes the fname parameter without output encoding\n- Confirm which version or commit of CloudClassroom-PHP-Project you run; the sources say version information is unavailable","fix":null,"status":"open","published_at":"2026-11-02T04:16:53+00:00","first_seen_at":"2026-11-02T04:51:28+00:00","triaged_at":"2026-11-02T04:52:21+00:00","updated_at":"2026-11-02T04:52:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T04:52:21Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"CloudClassroom-PHP-Project: XSS via fname parameter in updatedetailsfromfaculty.php","impact":"medium","summary":"A cross-site scripting flaw in the updatedetailsfromfaculty.php file of the CloudClassroom-PHP-Project lets an attacker manipulate the fname argument to inject script. An attacker can run script in the browser of a user who opens the crafted page, and the exploit has been published.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","cloudclassroom-php-project","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs script in a logged-in user's browser session","analyst_note":"Confirm whether the endpoint requires authentication and whether the project has a patched commit; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120339.","how_to_check":"- Look for updatedetailsfromfaculty.php in your CloudClassroom-PHP-Project deployment and check whether it echoes the fname parameter without output encoding\n- Confirm which version or commit of CloudClassroom-PHP-Project you run; the sources say version information is unavailable","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","output-escaped"],"who_is_affected":"Any deployment of CloudClassroom-PHP-Project that serves updatedetailsfromfaculty.php is exposed when the fname argument is reflected into the page. Teams that do not run this project, or that have a modified copy which escapes fname, can skip it. The sources do not say which versions are affected because the project uses a rolling release.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4199,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120339':13A,16A '-2026':12A,15A 'affect':88C,145C 'argument':48B,100C 'attack':44B,53B,108C,126C 'avail':151C 'browser':59B 'cloudclassroom':2A,18B,39B,83C 'cloudclassroom-php-project':1A,17B,38B,82C 'code':90C 'contact':155C 'continu':136C 'craft':66B 'cross':28B,104C 'cross-sit':27B 'cve':11A,14A 'deliv':135C 'disclosur':159C 'discov':79C 'earli':156C 'exploit':70B,114C 'file':35B,93C 'flaw':31B,76C 'fname':7A,47B,101C 'host':25B 'inform':143C 'initi':111C 'inject':50B 'let':42B 'manipul':45B,97C 'mathurvish':81C 'may':109C,122C 'model':133C 'open':64B 'packag':21B 'page':67B 'paramet':8A 'perform':95C 'php':3A,19B,22B,40B,84C 'product':128C 'project':4A,20B,41B,85C 'public':120C 'publish':73B 'releas':117C,132C,148C 'remot':112C 'respond':163C 'result':102C,140C 'roll':131C 'run':55B 'script':30B,51B,56B,106C 'secur':75C 'self':24B 'self-host':23B 'site':29B,105C 'specif':141C 'unknown':89C 'updat':137C,147C 'updatedetailsfromfaculty.php':10A,34B,94C 'use':124C,129C 'user':62B 'vendor':153C 'version':142C 'via':6A 'vulner':87C 'way':166C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Any deployment of CloudClassroom-PHP-Project that serves updatedetailsfromfaculty.php is exposed when the fname argument is reflected into the page. Teams that do not run this project, or that have a modified copy which escapes fname, can skip it. The sources do not say which versions are affected because the project uses a rolling release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudclassroomphpproject","medium","package","php","selfhosted"],"first_public_at":"2026-11-02T04:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120339","severity":null,"published_at":"2026-11-02T04:16:53+00:00","modified_at":"2026-11-02T04:16:53+00:00","first_seen_at":"2026-11-02T04:51:28+00:00","fetched_at":"2026-11-02T04:51:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}