Live › vulnerability › CVE-2026-121502
A PHP classroom project's facultydetails.php page passes the deleteid parameter into a SQL query without sanitizing it. An attacker can send crafted requests to read or change database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running a copy of mathurvishal/CloudClassroom-PHP-Project (a rolling-release PHP/MySQL classroom app) that includes facultydetails.php. In the master file, deleteid goes unescaped into a DELETE statement. The file redirects to AdminLogin.php when no session is set, but the code shown has no exit after the redirect, so the query may still run for unauthenticated requests (not tested). Anyone not running this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CloudClassroom-PHP-Project | github | rolling release, no versions; master facultydetails.php as read 2026-11-03 | – |
deleteid] is put straight into the query (DELETE FROM facutlytable WHERE FID = $deleteid) with no cast or prepared statementNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121502")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.