CVE-2026-100311
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected component is Faculty Video Management in managevideos2.php, and manipulation of arguments V_Title/V_Url/V_Remarks allows remote attacks. The exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Apply vendor patches or implement input sanitization. Restrict access to managevideos2.php and educate users about XSS risks.
Other vulnerabilities in CloudClassroom-PHP-Project
See all- CVE-2026-101013High
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Manipulation of the argument editid leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-100877Medium
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be affecting an unknown functionality of registrationform.php. Manipulation of the FName/LName/Addrs arguments leads to cross site scripting and can be executed remotely.
- CVE-2026-100875High
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. An unknown function in updatedetailsfromfaculty.php is affected by SQL injection via the myfid argument. The attack can be launched remotely and the exploit is public.
- CVE-2026-100874High
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. An unknown function in addnewstudent.php is affected by SQL injection. The attack can be launched remotely and the exploit is public.
- CVE-2026-100314High
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to a specific commit, with SQL injection in updatedetailsfromstudent.php via the eno argument. The attack can be initiated remotely.
- CVE-2026-101012High
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. Manipulation of the argument makeid causes SQL injection. The attack can be initiated remotely, and the exploit has been made available to the public.
- CVE-2026-100894Medium
A vulnerability was identified in CloudClassroom-PHP-Project allowing SQL injection in updateguest.php via the gname argument. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-100876Medium
A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be affecting an unknown function of loginlinkstudent.php. Manipulation of the umail argument results in missing authentication and can be exploited remotely.
- CVE-2026-100873Medium
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be affecting an unknown function. The manipulation results in cross-site request forgery and can be launched remotely.
- CVE-2026-100739High
A SQL injection vulnerability was detected in CloudClassroom-PHP-Project in the viewresult.php file, triggered by manipulating the seno argument. The flaw can be exploited remotely and a public exploit is already available. The product follows a rolling release model, so no specific version details are provided, and the vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS