CloudClassroom PHP Project CVE-2026-120339

Exploitation targets the 'fname' argument processed by the updatedetailsfromfaculty.php endpoint of CloudClassroom-PHP-Project. Per the input CVSS, the attack is remote with no authentication claimed (PR:N) but requires passive user interaction (UI:P) - a victim must load the page where the injected value is rendered for the script to execute, which is the primary limiting factor. Note a conflict: the referenced advisory and endpoint name ('update details from faculty', stored XSS) suggest the payload is submitted through an authenticated faculty/admin detail-update flow, which would raise the real privilege requirement above PR:N; this should be confirmed against the advisory. No fixed version exists because the product follows a rolling release model, so there is no version-gated condition to rely on.

This is a low-priority issue despite being remotely reachable. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) yields a base score of only 2.1, driven entirely by a low integrity impact (VI:L) with no confidentiality or availability impact (VC:N/VA:N) and no scope/subsequent-system impact (SC:N/SI:N) - consistent with a reflected-or-stored XSS that executes script in a victim's browser rather than compromising the server. The vuln.today decision label is 'monitor', the lowest urgency tier, and there is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or widespread exploitation. Exploitation status is limited: a public PoC reference exists (a GitHub advisory write-up) but it is not verified as working exploit code, so this should not be conflated with active exploitation. A notable tension: the input vector states PR:N (unauthenticated) and the description frames it as manipulating the 'fname' argument remotely, yet the referenced advisory filename ('updatedetailsfromfaculty-stored-xss.md') and the endpoint name (a faculty detail-update page) imply the payload is stored via an authenticated faculty/admin workflow - verify the actual trigger and auth requirement with the advisory before accepting PR:N. The affected product is a small open-source student/demo project, so real-world exposure is minimal regardless of the flaw class.

An attacker places a crafted script payload in the 'fname' parameter handled by updatedetailsfromfaculty.php; when the stored/reflected value is later rendered, the script executes in the browser of a user viewing the page, enabling session or UI manipulation in that user's context. A public PoC reference exists (a GitHub advisory write-up) but it is not verified as working exploit code. The UI:P metric indicates a victim must view the affected page for the payload to fire, limiting it to a passive-interaction attack rather than fully automated exploitation.