mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting
Affects CloudClassroom-PHP-Project at commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be, where stored script in manageassessment2.php runs for faculty or students who open the affected assessment. No fix is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be of CloudClassroom-PHP-Project An authenticated faculty member or student must open a page that renders the stored assessment data
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 40/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The CloudClassroom-PHP-Project, a PHP-based classroom management web application, is affected through its assessment management page. Attackers can remotely inject malicious scripts through the exam name and question fields, which could run in other users' browsers and potentially let attackers steal session data or perform actions on behalf of logged-in users.
Read the original description
A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
What to do
Check whether your setup matches what the bug needs.
Affected commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be of CloudClassroom-PHP-Project An authenticated faculty member or student must open a page that renders the stored assessment dataWorkaround: The checked facts give no workaround or interim mitigation. They identify only the affected commit and the pages that render the stored assessment data.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- mathurvishal CloudClassroom-PHP-Project
Version range not reported
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120343
What does this mean?
Stored JavaScript in assessment data runs in the application's origin when a victim views the affected assessment. The script can read page content, make same-origin requests as the victim, change data the victim can access, or show phishing content.Source: github.com
Am I affected, and how do I check?
The confirmed affected commit is 5dadec098bfbbf3300d60c3494db3fb95b66e7be of CloudClassroom-PHP-Project, and no version ranges are listed. A reader can compare the commit of their copy against that hash, and the issue appears on pages that render stored assessment data, such as manageassessment2.php and takeassessment2.php.Source: github.com
What should I do about it?
The checked facts list no fixed version or upgrade target. No remediation step beyond the affected commit is given.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts give no workaround or interim mitigation. They identify only the affected commit and the pages that render the stored assessment data.Source: github.com