CVE-2026-7196
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL Injection vulnerability in CodeAstro Online Classroom 1.0. Manipulation of the deleteid argument in /guestdetails allows remote SQL injection.
Risk Assessment
An attacker can read, modify, or delete database data, leading to loss of confidentiality and integrity.
Recommendation
Apply input filtering and use parameterized queries. Update the system if a patch is available.
Other vulnerabilities in CodeAstro Online Classroom
See all- CVE-2026-16765High
In the file /OnlineClassroom/loginlinkadmin.php of CodeAstro Online Classroom 1.0, there is an SQL injection vulnerability via the aid argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-5580Medium
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-5579Medium
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-5578Medium
In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.
Original NVD description (English source)
A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of the argument deleteid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS