CloudClassroom PHP Project CVE-2026-120341

Exploitation targets the studentdetails.php endpoint of CloudClassroom-PHP-Project and relies on an Execution After Redirect flaw (CWE-698): the script issues a redirect intended to enforce access control but continues executing and emits the protected student data in the response body. Per the CVSS vector it is network-reachable with low complexity and no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), so no special configuration is named as a prerequisite in the available sources. Limiting factors: the real-world footprint is tiny (an obscure rolling-release GitHub project), there is no verified working exploit (PoC reference only, E:P), impact is confined to low-grade disclosure with no scope change, and no fixed version exists because the vendor did not respond and ships continuously - mitigation specifics are not stated in the sources.

This is a modest-severity information-disclosure flaw whose signals point to low real-world urgency despite being remotely reachable. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated access, but the impact is capped at low across confidentiality, integrity and availability (VC:L/VI:L/VA:L, SC/SI/SA all N - no scope change), yielding a 6.9 base score. The CWE-698 (Execution After Redirect) classification plus the 'details-plaintext-disclosure' advisory indicate the practical effect is leakage of student-record data that should have been gated behind a redirect/authorization check, not code execution. Exploitation maturity is E:P (proof-of-concept), and the input explicitly marks the PoC as a reference only, not verified as working exploit code, so this is 'a public PoC reference exists; it is not verified as working exploit code' rather than confirmed weaponization. There is no CISA KEV listing and no EPSS value supplied, so widespread or automated exploitation cannot be asserted. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-critical fix priority. Net: a legitimate confidentiality issue to remediate on a routine cycle, not a drop-everything emergency - the main caveat is that EPSS is absent and the product is a rolling-release GitHub project with no version anchors.

An unauthenticated remote attacker requests studentdetails.php directly; because the application continues executing and emits sensitive output after issuing a redirect (Execution After Redirect), the student detail records are returned in plaintext rather than being withheld behind the intended access check. A public PoC reference describing this plaintext disclosure exists, though it is not verified as working exploit code, and no authentication or user interaction is required per the CVSS vector.