CloudClassroom PHP Project CVE-2026-100877

Reachable remotely and unauthenticated against the public registrationform.php registration form of mathurvishal CloudClassroom-PHP-Project; the attacker needs no credentials to inject the payload. Exploitation is LIMITED by the requirement that a victim subsequently render the injected FName/LName/Addrs value in a browser (UI/user interaction, reflected in the vendor UI:P), and by the product's near-zero deployment footprint. Because it is a rolling-release project with no versioning and an unresponsive vendor, there is no patched build to upgrade to; mitigation requires manual output encoding of these fields.

This is a low-real-world-priority issue despite a moderate 5.3 CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N, E:P) describes a remotely reachable but interaction-dependent cross-site scripting flaw with only limited integrity impact and no confidentiality or availability impact. There is publicly available exploit code (rmsbpro Advisory + VulDB 410807), but there is no EPSS score and no CISA KEV listing provided, so exploitation is 'publicly available exploit code exists' - NOT confirmed active exploitation. The E:P (Proof-of-Concept) in the 4.0 vector is consistent with the POC-published-but-not-weaponized signal. The dominant risk-reducing factors are the product itself (an unversioned hobby PHP project on GitHub with negligible production footprint) and the requirement for victim interaction (UI:P). One nuance worth flagging: the linked exploit file is named 'registrationform-stored-xss.md', implying STORED XSS, whereas the terse description and the vendor's UI:P/VI:L scoring read more like a reflected/low-impact case - if stored, the realistic impact (persistent script execution against staff/other users viewing registrations) is somewhat higher than the vendor score implies. Overall: high-visibility disclosure pipeline (VulDB), low genuine risk.

An unauthenticated attacker submits the public registration form (registrationform.php) with a malicious script payload in the FName, LName, or Addrs fields. When the stored/reflected value is later rendered without output encoding - e.g. viewed by an administrator or another user - the script executes in that victim's browser, enabling session/UI manipulation. Public exploit code for this exact injection point is available.