CloudClassroom PHP EUVD-2026-87814

No special conditions - remote unauthenticated exploitation is possible against a deployed instance of mathurvishal CloudClassroom-PHP-Project by manipulating the 'seno' argument of viewresult.php. The only practical limiter is exposure: the affected application must be publicly reachable and this endpoint accessible. No authentication (PR:N), no user interaction (UI:N), and no non-default configuration are required. There is no vendor patch, as the vendor did not respond and the project follows a rolling-release model with no versioned fix.

This is a classic high-volume, low-real-priority disclosure. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, and the VulDB E:P (Proof-of-Concept) exploit maturity plus the description's statement that 'the exploit is now public' means publicly available exploit code exists. However, the vendor's own score is only 5.5 (Medium) because impacts are rated partial (VC:L/VI:L/VA:L). No EPSS score or CISA KEV listing is provided in the input, and there is no evidence of active exploitation - the POC signal is distinct from in-the-wild use. The single most important limiting factor is the target itself: 'CloudClassroom-PHP-Project' by GitHub user mathurvishal is an educational/hobby PHP application with negligible production footprint, so despite the trivially exploitable network-facing SQL injection, real-world risk is very low. Note also that the assigned CWE-74 is the broad 'Injection' parent class; the actual weakness is SQL injection (CWE-89), which VulDB's 'SQLi' tag correctly reflects. The vendor did not respond to disclosure, so no fix version is confirmed and the rolling-release model means no clean 'fixed-in' version exists.

A remote, unauthenticated attacker sends a crafted value in the 'seno' parameter to viewresult.php, injecting SQL that the application concatenates directly into a database query. Because a public proof-of-concept exists (advisory published on GitHub), an attacker can extract data from the backend database - for example, dumping stored student results or credential tables. No authentication, user interaction, or special configuration is required.