EUVD-2026-115066
GHSA-hv93-gxq2-x4cw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor-supplied CVSS 4.0 base score is 2.1 (Low), driven by a limited integrity-only impact (VI:L) with no confidentiality or availability effect (VC:N/VA:N) and no impact to subsequent systems (SC:N/SI:N/SA:N). The vuln.today decision label is 'monitor', the weakest urgency tier. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS probability was supplied in the input, so widespread-exploitation likelihood cannot be quantified from this data. The CVSS vector encodes PR:N (no privileges) and UI:P (passive user interaction required) with AV:N/AC:L, which describes a network-reachable stored XSS that nonetheless depends on a victim loading the poisoned page. The one caveat worth flagging: PR:N conflicts with the nature of the sink - manageassessment2.php is an assessment-management function whose ExamName/Q1-Q5 inputs are normally submitted by an authenticated teacher/admin, so the 'no privileges' rating may overstate how open the write path is; this should be verified against the application's actual access control. Net: a real but minor hygiene issue, not an incident-grade priority. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Stored cross-site scripting in CloudClassroom-PHP-Project's manageassessment2.php allows remote unauthenticated attackers to supply crafted ExamName or Q1-Q5 values that execute script in a victim's browser when the page is viewed, with the CVSS 4.0 vector requiring user interaction. The issue is low severity (CVSS 2.1) and the supplied priority label is monitor; a public PoC reference exists, but it is not verified as working exploit code, and no KEV confirmation is present in the supplied intelligence.
RemediationAI
No vendor-released patch was identified at time of analysis; the vendor did not respond, and the rolling release model means no fixed version is specified. Until a fix is available, restrict access to manageassessment2.php to trusted users or an allowlist of management networks, recognizing that this may block legitimate assessment administration; add server-side validation and context-aware output encoding for ExamName and Q1-Q5, which requires code changes but addresses the root cause; deploy WAF rules targeting XSS in those parameters as virtual patching, with the trade-off of possible false positives; and remove or disable the script if assessment management is not needed. Monitor the VulDB advisory at https://vuldb.com/vuln/429668 and the public PoC reference at https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md for updated guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CloudClassroom-PHP-Project is a PHP web application, and CVE-2026-120343 maps to CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly called cross-site scripting). The affected code path is manageassessment2.php, where the ExamName and Q1 through Q5 arguments are handled; the exact function and whether the payload is stored or reflected are not described in the available sources, although the linked PoC reference is titled manageassessment2-stored-xss. The CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* uses a wildcard version because the project follows a rolling release model, so specific affected or fixed releases cannot be enumerated. The CVSS 4.0 vector describes a network-reachable, low-complexity issue with no privileges required (PR:N), user interaction (UI:P), and limited integrity impact only, consistent with script execution in a victim's browser rather than server compromise.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB