CVE-2026-16765
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In the file /OnlineClassroom/loginlinkadmin.php of CodeAstro Online Classroom 1.0, there is an SQL injection vulnerability via the aid argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, potentially compromising system confidentiality and integrity.
Recommendation
Immediately update the application to the latest version or apply a security patch to prevent SQL injection, e.g., by input validation and using prepared statements.
Other vulnerabilities in CodeAstro Online Classroom
See all- CVE-2026-7196Medium
SQL Injection vulnerability in CodeAstro Online Classroom 1.0. Manipulation of the deleteid argument in /guestdetails allows remote SQL injection.
- CVE-2026-5580Medium
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-5579Medium
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-5578Medium
In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.