Is there a public PoC exploit available for CVE-2026-16765?

Yes, a public proof-of-concept exploit is available for CVE-2026-16765. Prioritise patching immediately. EPSS: 0.3%.

Online Classroom CVE-2026-16765

Q: What is the CVSS score of CVE-2026-16765?

CVE-2026-16765 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48444 MEDIUM

SQL Injection (CWE-89)

2026-07-23 VulDB

GHSA-ghmg-mfwh-wccv

PHP SQLi Online Classroom Codeastro

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated admin login endpoint; availability omitted as SQLi here enables auth bypass, not denial of service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:32 vuln.today

CVSS changed

Jul 23, 2026 - 22:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 23, 2026 - 21:45 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint /OnlineClassroom/loginlinkadmin.php to unauthenticated remote attackers who can manipulate the aid parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal.

Technical ContextAI

CodeAstro Online Classroom is a PHP-based web application for managing virtual classrooms, identified by CPE cpe:2.3:a:codeastro:online_classroom:*:*:*:*:*:*:*:*. The vulnerability resides in the admin-facing login handler loginlinkadmin.php, where the aid parameter is interpolated directly into a SQL query without sanitization or use of prepared statements. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in a SQL Command) flaw - the root cause is concatenation of user-controlled input into a SQL string rather than use of parameterized queries or an ORM that enforces separation of code and data. Because the injection point sits on an authentication page, exploitation can trivially produce an authentication bypass (e.g., via ' OR '1'='1 style payloads) in addition to data extraction or manipulation.

RemediationAI

No vendor-released patch has been identified at time of analysis. Operators should immediately restrict network access to /OnlineClassroom/loginlinkadmin.php using firewall rules or web server configuration (e.g., deny all directives scoped to the admin login path) to limit exposure to trusted IP ranges only - this is the most effective compensating control with minimal operational disruption. Deploy a web application firewall rule to block SQL metacharacters (single quotes, comment sequences, UNION keywords) in the aid parameter as a secondary layer; note this can be bypassed by sophisticated encoding and should not substitute for a code fix. Code-level remediation requires replacing string-concatenated SQL queries in loginlinkadmin.php with PHP PDO or MySQLi prepared statements with bound parameters. Contact the vendor at https://codeastro.com/ for an official patch. Track the VulDB advisory at https://vuldb.com/vuln/382637 for patch release updates.