{"id":"CVE-2026-120343","kind":"vulnerability","aliases":["CVE-2026-120343"],"related":[],"title":"CloudClassroom-PHP-Project: cross-site scripting in assessment form fields","description":"A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The CloudClassroom-PHP-Project web app does not sanitize the ExamName and Q1 to Q5 fields in manageassessment2.php. An attacker can inject script that runs in the browser of a user who views the page.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudclassroom-php-project","package","php","self-hosted"],"not_affected_if":["not-deployed","page-not-exposed"],"how_to_check":"- Look for manageassessment2.php in the deployed CloudClassroom-PHP-Project code.\n- Check whether the ExamName, Q1, Q2, Q3, Q4 or Q5 values are echoed back to the page without escaping.","fix":null,"status":"open","published_at":"2026-11-02T05:18:24+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","triaged_at":"2026-11-02T05:23:32+00:00","updated_at":"2026-11-02T05:23:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T05:23:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudClassroom-PHP-Project: cross-site scripting in assessment form fields","impact":"medium","summary":"The CloudClassroom-PHP-Project web app does not sanitize the ExamName and Q1 to Q5 fields in manageassessment2.php. An attacker can inject script that runs in the browser of a user who views the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","cloudclassroom-php-project","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in users' browsers, session data can be stolen","analyst_note":"Confirm whether manageassessment2.php requires login and whether any fixed version or patched commit exists; the NVD entry is the only source given.","how_to_check":"- Look for manageassessment2.php in the deployed CloudClassroom-PHP-Project code.\n- Check whether the ExamName, Q1, Q2, Q3, Q4 or Q5 values are echoed back to the page without escaping.\n- unknown for affected versions: the sources say the project uses a rolling release and no version ranges are given.","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","page-not-exposed"],"who_is_affected":"Any deployment of CloudClassroom-PHP-Project that exposes manageassessment2.php to users is potentially exposed. The sources say the project is a rolling release with no version details, and the vendor did not respond to disclosure. Teams that do not run this project, or that do not expose the assessment management page, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4208,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120343':15A,18A '-2026':14A,17A 'adopt':116C 'affect':129C 'app':34B 'argument':90C 'assess':10A 'attack':48B,97C 'browser':56B 'cannot':133C 'carri':102C 'caus':92C 'cloudclassroom':2A,20B,30B,72C 'cloudclassroom-php-project':1A,19B,29B,71C 'contact':139C 'continu':123C 'cross':6A,93C 'cross-sit':5A 'cve':13A,16A 'deliveri':124C 'detail':127C 'disclosur':143C 'earli':140C 'element':77C 'examnam':39B 'examname/q1/q2/q3/q4/q5':91C 'exploit':106C 'field':12A,44B 'file':84C 'flaw':65C 'form':11A 'found':68C 'function':81C 'host':27B 'impact':76C 'inject':50B 'maintain':122C 'manageassessment2.php':46B,85C 'manipul':87C 'mathurvish':70C 'may':111C 'packag':23B 'page':63B 'php':3A,21B,24B,31B,73C 'possibl':99C 'product':115C 'project':4A,22B,32B,74C 'publish':109C 'q1':41B 'q5':43B 'releas':119C,132C 'remot':104C 'respond':147C 'roll':118C 'run':53B 'sanit':37B 'script':8A,51B,95C 'self':26B 'self-host':25B 'site':7A,94C 'specifi':135C 'strategi':120C 'therefor':125C 'unknown':80C 'updat':131C 'use':113C 'user':59B 'vendor':137C 'version':126C 'view':61B 'way':150C 'web':33B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of CloudClassroom-PHP-Project that exposes manageassessment2.php to users is potentially exposed. The sources say the project is a rolling release with no version details, and the vendor did not respond to disclosure. Teams that do not run this project, or that do not expose the assessment management page, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudclassroomphpproject","medium","package","php","selfhosted"],"first_public_at":"2026-11-02T05:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120343","severity":null,"published_at":"2026-11-02T05:18:24+00:00","modified_at":"2026-11-02T05:18:24+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","fetched_at":"2026-11-02T05:21:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}