---
id: "CVE-2026-120339"
kind: "vulnerability"
aliases: ["CVE-2026-120339"]
title: "CloudClassroom-PHP-Project: XSS via fname parameter in updatedetailsfromfaculty.php"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudclassroom-php-project", "package", "php", "self-hosted"]
not_affected_if: ["not-deployed", "output-escaped"]
published_at: "2026-11-02T04:16:53+00:00"
first_seen_at: "2026-11-02T04:51:28+00:00"
updated_at: "2026-11-02T04:52:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120339", "first_seen_at": "2026-11-02T04:51:28+00:00"}]
---

# CloudClassroom-PHP-Project: XSS via fname parameter in updatedetailsfromfaculty.php

A cross-site scripting flaw in the updatedetailsfromfaculty.php file of the CloudClassroom-PHP-Project lets an attacker manipulate the fname argument to inject script. An attacker can run script in the browser of a user who opens the crafted page, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for updatedetailsfromfaculty.php in your CloudClassroom-PHP-Project deployment and check whether it echoes the fname parameter without output encoding
- Confirm which version or commit of CloudClassroom-PHP-Project you run; the sources say version information is unavailable

## Timeline

- 2026-11-02T04:51:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120339

## From the sources

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_