CVE-2026-5579
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data leakage or application takeover.
Recommendation
Immediately implement parameterized SQL queries or prepared statements in updatedetailsfromfaculty.php and restrict access to this file.
Other vulnerabilities in CodeAstro Online Classroom
See all- CVE-2026-16765High
In the file /OnlineClassroom/loginlinkadmin.php of CodeAstro Online Classroom 1.0, there is an SQL injection vulnerability via the aid argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-7196Medium
SQL Injection vulnerability in CodeAstro Online Classroom 1.0. Manipulation of the deleteid argument in /guestdetails allows remote SQL injection.
- CVE-2026-5580Medium
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-5578Medium
In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 of the component Parameter Handler. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS