Live › vulnerability › CVE-2026-120342
The mathurvishal CloudClassroom-PHP-Project has an SQL injection flaw in the eid argument of viewquery.php. A remote attacker can send crafted input to read or alter the application's database, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 05:21 UTC. All times on this page are UTC.
Anyone running the open-source CloudClassroom-PHP-Project (mathurvishal) e-learning app, typically self-hosted on XAMPP/PHP and MySQL, with viewquery.php reachable. VulDB states no authentication is needed, so it can be exploited remotely. The project has no versions (rolling release), so every copy built from the listed commits should be treated as affected. Anyone not running this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CloudClassroom-PHP-Project | other | commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release, no versions) | – |
eid] and puts it straight into: SELECT * FROM query WHERE Eid=$seidEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120342")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.