CVE-2026-97884
MediumCVSS 6.3Summary
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
SQL injection can enable an attacker to gain unauthorized access to the database, modify or steal students' personal data. This can lead to privacy breaches and legal consequences.
Recommendation
As the product does not use versioning, immediately implement mitigations such as input validation and query parameterization. Contact the vendor for a fix despite no response.
Other vulnerabilities in CloudClassroom-PHP-Project
See all- CVE-2026-97886Medium
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-97885High
A flaw was found in the CloudClassroom-PHP-Project in an unknown function of the file updatefaculty.php. Manipulation of the fid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-97883High
A security vulnerability was detected in the CloudClassroom-PHP-Project in an unknown function of the file updatequery.php. Manipulation of the gid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-97882High
A weakness was identified in the CloudClassroom-PHP-Project in an unknown function of the file loginlinkfaculty.php of the Faculty Authentication component. Manipulation of the fid/pass arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS