CVE-2026-5578

MediumCVSS 6.3

Published: 05/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.

Risk Assessment

An attacker can remotely steal, modify, or delete database data, leading to data confidentiality and integrity breaches.

Recommendation

Immediately apply a patch or update the software. If unavailable, implement input validation and parameterized SQL queries.

Original NVD description (English source)

A vulnerability was found in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /OnlineClassroom/addassessment.php of the component Parameter Handler. Performing a manipulation of the argument deleteid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.