CVE-2026-5580
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, compromising the confidentiality and integrity of the system.
Recommendation
Immediately implement parameterized SQL queries or prepared statements in addvideos.php and restrict access to this file.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/addvideos.php of the component Parameter Handler. The manipulation of the argument videotitle leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.