EUVD-2026-87543
GHSA-jm43-phf9-333q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as faculty user
-
DeliveryInject script into V_Title/V_Url/V_Remarks
-
ExploitPayload stored in video record
-
ExecutionVictim views video page
-
ImpactScript executes in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with faculty/video-management privileges (PR:L) to reach the managevideos2.php Faculty Video Management endpoint and store a payload in the V_Title, V_Url, or V_Remarks argument. Exploitation additionally requires victim user interaction (UI:P) - a second user must load the page rendering the stored payload for the script to execute. Limiting factors: no unauthenticated path, dependence on a victim viewing the content, and impact restricted to script execution in the browser context (no server-side confidentiality or availability impact). No fixed version exists due to the rolling-release model. |
| Impact | This is a low-real-risk issue despite being a genuine, POC-backed vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) describes a network-reachable but privilege-and-interaction-gated flaw: an attacker needs faculty-level authentication (PR:L) to reach the video-management form, and a victim must view the injected content (UI:P) for the script to fire. Impact is confined to low integrity (VI:L) with no confidentiality or availability effect, hence the very low 2.0 base score. Exploitation status: publicly available exploit code exists (VulDB/GitHub raffarj), but this is NOT active exploitation - there is no CISA KEV listing and no EPSS score in the provided data. The E:P (Proof-of-Concept) exploit maturity in the vector aligns with the POC signal and does not indicate weaponization. No signals conflict, but note that EPSS is absent entirely, so probabilistic exploitation likelihood cannot be quantified; given the product's obscurity, real-world exploitation is expected to be negligible. This is a high-confidence 'real but trivial' XSS in a niche project, not a prioritization concern for most defenders. |
| Exploit ScenarioDerived | An authenticated faculty user submits a video record via managevideos2.php with a malicious script payload in the V_Title, V_Url, or V_Remarks field, which is stored and rendered without sanitization. When another user (e.g., an administrator or student) views the affected video listing, the script executes in their browser session. A public proof-of-concept for this vulnerability is available on GitHub (raffarj/CVE). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Stored cross-site scripting in mathurvishal's CloudClassroom-PHP-Project allows an authenticated faculty-level user to inject script payloads via the V_Title, V_Url, or V_Remarks arguments of managevideos2.php in the Faculty Video Management component, which then execute in the browser of any other user who views the affected video listing. Exploitation requires a valid account with video-management privileges and a victim who loads the poisoned page, so it is not remotely triggerable by an unauthenticated attacker, and the resulting impact is confined to browser-context script execution with no server-side confidentiality or availability loss. Publicly available exploit code exists, the vendor was contacted but did not respond, the project follows a rolling-release model so no fixed version is identified, and no CISA KEV entry confirms active exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis: the maintainer of CloudClassroom-PHP-Project did not respond to the disclosure, and the project uses a rolling-release model that publishes no version numbers, so there is no fixed release to upgrade to - upgrade only becomes meaningful if the upstream repository later ships a corrected managevideos2.php. In the absence of a patch, apply compensating controls directly to the vulnerable endpoint: restrict access to managevideos2.php and the entire Faculty Video Management area to accounts that genuinely require it, using server-side role checks rather than client-side navigation, which reduces the number of authenticated users who can be abused as a delivery vector; the trade-off is added administrative overhead and possible workflow disruption for faculty staff. Harden output handling by applying htmlspecialchars() with ENT_QUOTES and the correct charset when echoing V_Title, V_Url, and V_Remarks, or by adding a Content-Security-Policy with a restrictive script-src (nonce or hash based) to neutralize inline script execution - a CSP that is too permissive provides no protection, and a strict CSP may break legitimate page functionality. As a network-level mitigation, place the application behind a WAF or reverse proxy that filters script-bearing content in the V_Title, V_Url, and V_Remarks form fields on both input and output; this is a defensive layer only, can be bypassed by encoding tricks, and requires ongoing rule maintenance. Finally, because public exploit code is available at https://github.com/raffarj/CVE/tree/main, limit the vulnerable application's exposure to trusted networks where feasible and monitor web logs for anomalous submissions to managevideos2.php; the authoritative assessment notes that successful exploitation additionally requires a victim to load the poisoned page (UI:R), so restricting where the video listing is viewed provides some marginal risk reduction.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 improper neutralization of input during web page generation - specifically a persistent (stored) cross-site scripting flaw - in the PHP application CloudClassroom-PHP-Project, tracked by the CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*. The affected endpoint, managevideos2.php, belongs to the Faculty Video Management component and accepts V_Title, V_Url, and V_Remarks parameters that are persisted without adequate output encoding. Because the injected values are written to the backend and later rendered to other users, the payload survives across requests and executes in the victim's session rather than the attacker's, which is what distinguishes stored XSS from reflected XSS. The application is publicly hosted PHP code distributed under a rolling-release model, so no discrete patched version exists and the CPE does not pin a specific release. The authoritative assessment assigns CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning network reachability, low attack complexity, but mandatory low-privilege authentication and victim interaction; the scope change reflects the fact that script escapes the vulnerable component into the victim's browser context. No server-side confidentiality or availability impact is present - only low integrity impact on the target page.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable form requires faculty authentication (PR:L) and victim viewing (UI:R); stored script executes in a separate browser authority (S:C) with low integrity/confidentiality impact and no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB