---
id: "CVE-2026-120343"
kind: "vulnerability"
aliases: ["CVE-2026-120343"]
title: "CloudClassroom-PHP-Project: cross-site scripting in assessment form fields"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudclassroom-php-project", "package", "php", "self-hosted"]
not_affected_if: ["not-deployed", "page-not-exposed"]
published_at: "2026-11-02T05:18:24+00:00"
first_seen_at: "2026-11-02T05:21:35+00:00"
updated_at: "2026-11-02T05:23:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120343", "first_seen_at": "2026-11-02T05:21:35+00:00"}]
---

# CloudClassroom-PHP-Project: cross-site scripting in assessment form fields

The CloudClassroom-PHP-Project web app does not sanitize the ExamName and Q1 to Q5 fields in manageassessment2.php. An attacker can inject script that runs in the browser of a user who views the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for manageassessment2.php in the deployed CloudClassroom-PHP-Project code.
- Check whether the ExamName, Q1, Q2, Q3, Q4 or Q5 values are echoed back to the page without escaping.

## Timeline

- 2026-11-02T05:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120343

## From the sources

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_