Live › vulnerability › CVE-2026-120343
The CloudClassroom-PHP-Project web app does not sanitize the ExamName and Q1 to Q5 fields in manageassessment2.php. An attacker can inject script that runs in the browser of a user who views the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 05:21 UTC. All times on this page are UTC.
Any deployment of CloudClassroom-PHP-Project that exposes manageassessment2.php to users is potentially exposed. The sources say the project is a rolling release with no version details, and the vendor did not respond to disclosure. Teams that do not run this project, or that do not expose the assessment management page, can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120343")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.