Live › vulnerability › CVE-2026-121501
A PHP course-management project's admin login script (loginlinkadmin.php) can be made to accept a session ID chosen by an attacker through the PHPSESSID argument. An attacker who gets a victim to log in with that session ID can then use the same session to act as the victim.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Anyone running the mathurvishal CloudClassroom-PHP-Project (a self-hosted PHP e-learning site) with the admin login loginlinkadmin.php reachable. The project has no versions, so no release can be named as affected or fixed; review any deployment. The attack needs the victim admin to log in using an attacker-supplied session ID (user interaction). Skip it if you do not run this project.
No product ranges from the sources yet.
umail] after a successful login, with no session_regenerate_id() callUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121501")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.