Cloudclassroom Php Project
Monthly
Stored cross-site scripting in CloudClassroom-PHP-Project allows an attacker to submit script content through the fname argument of addnewstudent.php, which is persisted and later rendered without output encoding, executing in the browser of any user who views the affected page. The CVSS 4.0 base score is 5.3 (medium), and the impact is limited to low integrity with no confidentiality or availability effect per the assessed vector. No CISA KEV listing is present and no public working exploit has been confirmed; a public PoC reference exists but is not verified as working exploit code, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
SQL injection in the updateresultdetails.php script of the CloudClassroom-PHP-Project allows remote attackers to manipulate the 'editid' parameter and potentially read or modify database contents. The vulnerability is confirmed by publicly available exploit code, and the vendor has not responded to disclosure, leaving all versions affected because the project lacks versioning. Despite a high technical severity (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), real-world risk is low due to the project's limited deployment as an unmaintained hobby application.
SQL injection in the makeresult.php script of mathurvishal's CloudClassroom-PHP-Project lets remote attackers tamper with the makeid parameter and inject arbitrary SQL into the application's database queries. Because the project ships only as a continuously-delivered rolling codebase with no tagged releases, every self-hosted deployment tracking upstream - up to and including commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be - should be considered affected, and publicly available exploit code exists (there is no CISA KEV entry, so active exploitation is not confirmed). The CVSS v4.0 score is 6.9, while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) weighs confidentiality loss as the dominant impact; overall risk stays moderate because exposure is limited to a small number of hobby/self-hosted instances of an unmaintained PHP application, and the vendor never responded to disclosure.
SQL injection in the CloudClassroom PHP Project's updateguest.php endpoint lets an attacker manipulate the 'gname' argument to inject arbitrary SQL into the application's database queries, enabling unauthorized read and partial modification of classroom data. The project is distributed as a rolling-release repository rather than versioned builds, so no discrete affected version can be enumerated, and the vendor was contacted about the disclosure but did not respond, leaving no released fix. Publicly available exploit code exists via the JaconiasDev advisory; there is no CISA KEV entry, so the activity level is proof-of-concept rather than confirmed active exploitation, and the disclosed CVSS v4.0 score of 5.3 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) reflects a moderate-severity issue whose practical risk is tempered by the product's very small deployment footprint.
Stored/reflected cross-site scripting in mathurvishal's CloudClassroom-PHP-Project lets remote, unauthenticated attackers submit script payloads through the FName, LName, and Addrs parameters of registrationform.php, which are then rendered unsanitized in a victim's browser. The project is a rolling-release PHP application with no version tags, so every known build up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be is presumed affected, and the vendor did not respond to disclosure. Publicly available exploit code exists (a GitHub advisory demonstrating the injection is linked from the CVE record); there is no evidence of confirmed active exploitation (not in CISA KEV), and the practical risk is limited by the near-zero deployment footprint of this project and by the user-interaction requirement (CVSS 4.0 UI:P; independently assessed CVSS 3.1 UI:R) for a victim to view the injected fields.
Missing authentication in loginlinkstudent.php of Mathurvishal CloudClassroom-PHP-Project allows remote unauthenticated attackers to bypass login checks by manipulating the umail parameter, potentially gaining access to student-scoped functions and data. The vulnerability (CVE-2026-100876) has a publicly available exploit, but no active exploitation has been confirmed. The independent assessment rates it as a genuine but low-priority issue due to the product's obscure, unversioned hobby-project nature and negligible real-world deployment.
SQL injection in the addnewstudent.php endpoint of mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL via user-supplied input, with the disclosed vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) and our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N both indicating no authentication barrier and a high confidentiality impact, with integrity loss limited to portions of the database reachable by the application's DB account. Publicly available exploit code exists: a proof-of-concept write-up was published on GitHub (vinniboy021-blip/Advisory, addnewstudent-sqli.md) complementing the VulDB entry, so the skill needed to weaponize the flaw is low, although there is no CISA KEV entry confirming active exploitation and no EPSS score was supplied. Practical exposure is heavily constrained because this is an unversioned, hobby-grade PHP project with no packaged releases, an unresponsive vendor, and an addnewstudent endpoint that in a real deployment may sit behind an administrative login even though the vector claims PR:N.
Cross-site request forgery in the CloudClassroom-PHP-Project PHP web application (repository state up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be) allows a remote attacker to cause a logged-in victim's browser to submit unintended, state-changing requests against the application without the victim's knowledge. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) agree that no attacker-side authentication is required but that a currently authenticated victim must be socially engineered into loading attacker-controlled content, which caps the realistic impact at low integrity modification rather than code execution or data disclosure. Publicly available exploit code exists (a public advisory with a CSRF proof-of-concept), but there is no evidence of confirmed active exploitation (not in CISA KEV), and the vendor did not respond to disclosure, so no official fix is available.
SQL injection in CloudClassroom-PHP-Project allows remote, unauthenticated attackers to manipulate the myfid parameter in mydetailsfaculty.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, but there is no confirmed active exploitation and no vendor-released patch because the project is unversioned and the maintainer did not respond. This is a genuine but low-priority issue that requires manual source-code remediation.
SQL injection in the 'eno' parameter handled by updatedetailsfromstudent.php in mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL into the application's database queries, with limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; our independent assessment scores it 6.1 under CVSS 3.1). The project uses rolling releases with no version tags, so no fixed build or specific affected release can be pinned, and the maintainer was contacted but did not respond, leaving no vendor patch. Publicly available exploit code exists, including a GitHub advisory with a proof-of-concept; there is no confirmation of active exploitation (not in CISA KEV). This is a genuine but low-priority issue confined to a niche, non-commercial PHP application.
Cross-site scripting (CWE-79) in the mathurvishal CloudClassroom-PHP-Project, reachable through the queryx parameter of updatequery.php, allows a remote unauthenticated attacker to have arbitrary script execute in a victim's browser session once that victim is induced to open a crafted request. The flaw affects the project through commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be; because the project follows a rolling-release model, no discrete affected or fixed version numbers are published. Publicly available exploit code exists (a GitHub advisory with a stored-XSS write-up) and the vendor did not respond to disclosure, but there is no confirmed actively exploited (CISA KEV) status; EPSS is not reported and the assessed CVSS:3.1 score is 5.3, making this a genuine-but-low-priority issue.
SQL injection in mathurvishal CloudClassroom-PHP-Project lets a low-privilege authenticated remote attacker manipulate the gname or editassid parameters of /updateguest.php to execute arbitrary SQL against the application's backend database, with low confidentiality, integrity and availability impact. Publicly available exploit code exists, and the CVSS 4.0 base score is 5.3 with an E:P (proof-of-concept exploit) temporal qualifier, but there is no evidence of confirmed active exploitation (not in CISA KEV). The practical risk is constrained by the project's niche, self-hosted footprint, the requirement for an authenticated session, and the absence of any vendor fix - the project ships as a rolling release and the maintainer did not respond to the disclosure.
Stored cross-site scripting in mathurvishal's CloudClassroom-PHP-Project allows an authenticated faculty-level user to inject script payloads via the V_Title, V_Url, or V_Remarks arguments of managevideos2.php in the Faculty Video Management component, which then execute in the browser of any other user who views the affected video listing. Exploitation requires a valid account with video-management privileges and a victim who loads the poisoned page, so it is not remotely triggerable by an unauthenticated attacker, and the resulting impact is confined to browser-context script execution with no server-side confidentiality or availability loss. Publicly available exploit code exists, the vendor was contacted but did not respond, the project follows a rolling-release model so no fixed version is identified, and no CISA KEV entry confirms active exploitation.
SQL injection in the editassid parameter of managevideos2.php in mathurvishal's CloudClassroom-PHP-Project lets an authenticated low-privilege user supply crafted input that is concatenated into a backend SQL query, allowing them to read from or modify the application's database. Publicly available exploit code exists (a proof-of-concept write-up is linked from the references), but there is no confirmed active exploitation in the wild and no CISA KEV listing; the provided CVSS 4.0 score is 2.1 and the independent re-assessment scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, treating it as a low real-world priority because valid credentials and a deployed instance of this niche, rolling-release PHP application are both required. The maintainer was contacted about the flaw and did not respond, and because the project ships as a rolling release there is no versioned affected or fixed release to point to.
SQL injection in the updatefaculty.php script of mathurvishal's CloudClassroom-PHP-Project allows remote attackers to inject arbitrary SQL through the unsanitized fid parameter, potentially reading or altering faculty records stored in the underlying database. Publicly available exploit code exists, published as a GitHub advisory with a SQLi proof-of-concept, and the vendor was contacted but never responded, so no fixed version is available; the CPE record (cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*) carries a wildcard version because the project uses a rolling-release model. Practical risk is bounded by the product's negligible production footprint as an obscure educational PHP project rather than by attack difficulty, making this a real but low-priority issue.
SQL injection in the updatestudent.php script of mathurvishal's CloudClassroom-PHP-Project lets an authenticated attacker inject arbitrary SQL through the unsanitized 'eno' parameter, allowing them to read or manipulate student records in the underlying database. The product is an unversioned educational PHP project hosted on GitHub, so all commits up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be are presumed affected and no fixed release exists. Publicly available exploit code exists (referenced from a GitHub repository alongside the VulDB entry), the vendor was contacted but never responded, and no CISA KEV entry indicates confirmed active exploitation.
SQL injection in mathurvishal's CloudClassroom-PHP-Project (updatequery.php) lets remote attackers manipulate the gid parameter to inject arbitrary SQL into the application's database queries, rated CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists via a GitHub advisory (proof-of-concept maturity per the E:P vector), but there is no CISA KEV listing and no evidence of active exploitation; CISA's SSVC assessment is Exploitation: poc, Automatable: yes, Technical Impact: partial. The vendor was contacted early and did not respond, and the project uses rolling releases, so no fixed version can be identified; combined with the product's near-zero deployment footprint, real-world risk is LOW.
SQL injection in the faculty authentication handler (loginlinkfaculty.php) of mathurvishal's CloudClassroom-PHP-Project lets unauthenticated remote attackers manipulate the fid or pass request arguments to alter the backend SQL query, potentially bypassing faculty login and reading or modifying application data. Exploitation needs only network reachability to the exposed login endpoint - the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with Low confidentiality, integrity, and availability impact (base 6.9), so no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists (a GitHub proof-of-concept demonstrating authentication bypass), but the practical risk is tempered by deployment scarcity: the vendor uses rolling releases, published no version details, responded to neither disclosure, and no vendor-released patch is currently identified.
SQL injection in CloudClassroom-PHP-Project's /postquerypublic.php endpoint allows unauthenticated remote attackers to manipulate the gnamex parameter and execute arbitrary database queries. Public exploit code is available for this vulnerability, and the vendor has not provided patches despite early disclosure notification. Affected systems using this PHP application up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are at immediate risk of data theft or manipulation.
SQL injection in CloudClassroom-PHP Project v1.0 exposes the application to remote, unauthenticated database manipulation via the `viewid` parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero prerequisites - any internet-accessible instance is directly exploitable without credentials. A publicly available proof-of-concept exists on GitHub, though EPSS at 0.31% (23rd percentile) indicates low observed exploitation probability at time of analysis, consistent with the obscure deployment footprint of this niche educational PHP application. No active exploitation is confirmed in CISA KEV.
CVE-2025-46179 is a critical SQL injection vulnerability in CloudClassroom-PHP Project v1.0's askquery.php file, where the 'squeryx' parameter is passed directly into SQL queries without sanitization. This affects all installations of CloudClassroom-PHP v1.0 and allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise including data exfiltration, modification, and denial of service. The vulnerability has a CVSS 9.8 score reflecting its network-based exploitability with no authentication or user interaction required; active exploitation status and POC availability are unknown from the provided data.
A remote code execution vulnerability in CloudClassroom-PHP-Project v1.0 (CVSS 9.8). Risk factors: public PoC available.
CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.
Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0, where the 'pass' parameter fails to properly validate user input, allowing unauthenticated attackers to inject arbitrary SQL queries over the network. This vulnerability can lead to confidentiality, integrity, and availability compromise with a CVSS score of 7.3 (High), though active exploitation status and proof-of-concept availability could not be verified from the provided data.
Time-based SQL injection vulnerability in the mydetailsstudent.php file of CloudClassroom PHP Project version 1.0, where the 'myds' parameter fails to properly validate user input, allowing unauthenticated remote attackers to inject and execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 (High), indicating potential for data theft, modification, and service disruption. No KEV status or active exploitation data is provided in the current intelligence; however, the network-accessible nature (CVSS:3.1/AV:N) and low attack complexity suggest this represents a significant real-world risk if the affected application is internet-facing.
A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessment function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in CloudClassroom-PHP-Project allows an attacker to submit script content through the fname argument of addnewstudent.php, which is persisted and later rendered without output encoding, executing in the browser of any user who views the affected page. The CVSS 4.0 base score is 5.3 (medium), and the impact is limited to low integrity with no confidentiality or availability effect per the assessed vector. No CISA KEV listing is present and no public working exploit has been confirmed; a public PoC reference exists but is not verified as working exploit code, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
SQL injection in the updateresultdetails.php script of the CloudClassroom-PHP-Project allows remote attackers to manipulate the 'editid' parameter and potentially read or modify database contents. The vulnerability is confirmed by publicly available exploit code, and the vendor has not responded to disclosure, leaving all versions affected because the project lacks versioning. Despite a high technical severity (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), real-world risk is low due to the project's limited deployment as an unmaintained hobby application.
SQL injection in the makeresult.php script of mathurvishal's CloudClassroom-PHP-Project lets remote attackers tamper with the makeid parameter and inject arbitrary SQL into the application's database queries. Because the project ships only as a continuously-delivered rolling codebase with no tagged releases, every self-hosted deployment tracking upstream - up to and including commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be - should be considered affected, and publicly available exploit code exists (there is no CISA KEV entry, so active exploitation is not confirmed). The CVSS v4.0 score is 6.9, while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) weighs confidentiality loss as the dominant impact; overall risk stays moderate because exposure is limited to a small number of hobby/self-hosted instances of an unmaintained PHP application, and the vendor never responded to disclosure.
SQL injection in the CloudClassroom PHP Project's updateguest.php endpoint lets an attacker manipulate the 'gname' argument to inject arbitrary SQL into the application's database queries, enabling unauthorized read and partial modification of classroom data. The project is distributed as a rolling-release repository rather than versioned builds, so no discrete affected version can be enumerated, and the vendor was contacted about the disclosure but did not respond, leaving no released fix. Publicly available exploit code exists via the JaconiasDev advisory; there is no CISA KEV entry, so the activity level is proof-of-concept rather than confirmed active exploitation, and the disclosed CVSS v4.0 score of 5.3 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) reflects a moderate-severity issue whose practical risk is tempered by the product's very small deployment footprint.
Stored/reflected cross-site scripting in mathurvishal's CloudClassroom-PHP-Project lets remote, unauthenticated attackers submit script payloads through the FName, LName, and Addrs parameters of registrationform.php, which are then rendered unsanitized in a victim's browser. The project is a rolling-release PHP application with no version tags, so every known build up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be is presumed affected, and the vendor did not respond to disclosure. Publicly available exploit code exists (a GitHub advisory demonstrating the injection is linked from the CVE record); there is no evidence of confirmed active exploitation (not in CISA KEV), and the practical risk is limited by the near-zero deployment footprint of this project and by the user-interaction requirement (CVSS 4.0 UI:P; independently assessed CVSS 3.1 UI:R) for a victim to view the injected fields.
Missing authentication in loginlinkstudent.php of Mathurvishal CloudClassroom-PHP-Project allows remote unauthenticated attackers to bypass login checks by manipulating the umail parameter, potentially gaining access to student-scoped functions and data. The vulnerability (CVE-2026-100876) has a publicly available exploit, but no active exploitation has been confirmed. The independent assessment rates it as a genuine but low-priority issue due to the product's obscure, unversioned hobby-project nature and negligible real-world deployment.
SQL injection in the addnewstudent.php endpoint of mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL via user-supplied input, with the disclosed vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) and our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N both indicating no authentication barrier and a high confidentiality impact, with integrity loss limited to portions of the database reachable by the application's DB account. Publicly available exploit code exists: a proof-of-concept write-up was published on GitHub (vinniboy021-blip/Advisory, addnewstudent-sqli.md) complementing the VulDB entry, so the skill needed to weaponize the flaw is low, although there is no CISA KEV entry confirming active exploitation and no EPSS score was supplied. Practical exposure is heavily constrained because this is an unversioned, hobby-grade PHP project with no packaged releases, an unresponsive vendor, and an addnewstudent endpoint that in a real deployment may sit behind an administrative login even though the vector claims PR:N.
Cross-site request forgery in the CloudClassroom-PHP-Project PHP web application (repository state up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be) allows a remote attacker to cause a logged-in victim's browser to submit unintended, state-changing requests against the application without the victim's knowledge. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) agree that no attacker-side authentication is required but that a currently authenticated victim must be socially engineered into loading attacker-controlled content, which caps the realistic impact at low integrity modification rather than code execution or data disclosure. Publicly available exploit code exists (a public advisory with a CSRF proof-of-concept), but there is no evidence of confirmed active exploitation (not in CISA KEV), and the vendor did not respond to disclosure, so no official fix is available.
SQL injection in CloudClassroom-PHP-Project allows remote, unauthenticated attackers to manipulate the myfid parameter in mydetailsfaculty.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, but there is no confirmed active exploitation and no vendor-released patch because the project is unversioned and the maintainer did not respond. This is a genuine but low-priority issue that requires manual source-code remediation.
SQL injection in the 'eno' parameter handled by updatedetailsfromstudent.php in mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL into the application's database queries, with limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; our independent assessment scores it 6.1 under CVSS 3.1). The project uses rolling releases with no version tags, so no fixed build or specific affected release can be pinned, and the maintainer was contacted but did not respond, leaving no vendor patch. Publicly available exploit code exists, including a GitHub advisory with a proof-of-concept; there is no confirmation of active exploitation (not in CISA KEV). This is a genuine but low-priority issue confined to a niche, non-commercial PHP application.
Cross-site scripting (CWE-79) in the mathurvishal CloudClassroom-PHP-Project, reachable through the queryx parameter of updatequery.php, allows a remote unauthenticated attacker to have arbitrary script execute in a victim's browser session once that victim is induced to open a crafted request. The flaw affects the project through commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be; because the project follows a rolling-release model, no discrete affected or fixed version numbers are published. Publicly available exploit code exists (a GitHub advisory with a stored-XSS write-up) and the vendor did not respond to disclosure, but there is no confirmed actively exploited (CISA KEV) status; EPSS is not reported and the assessed CVSS:3.1 score is 5.3, making this a genuine-but-low-priority issue.
SQL injection in mathurvishal CloudClassroom-PHP-Project lets a low-privilege authenticated remote attacker manipulate the gname or editassid parameters of /updateguest.php to execute arbitrary SQL against the application's backend database, with low confidentiality, integrity and availability impact. Publicly available exploit code exists, and the CVSS 4.0 base score is 5.3 with an E:P (proof-of-concept exploit) temporal qualifier, but there is no evidence of confirmed active exploitation (not in CISA KEV). The practical risk is constrained by the project's niche, self-hosted footprint, the requirement for an authenticated session, and the absence of any vendor fix - the project ships as a rolling release and the maintainer did not respond to the disclosure.
Stored cross-site scripting in mathurvishal's CloudClassroom-PHP-Project allows an authenticated faculty-level user to inject script payloads via the V_Title, V_Url, or V_Remarks arguments of managevideos2.php in the Faculty Video Management component, which then execute in the browser of any other user who views the affected video listing. Exploitation requires a valid account with video-management privileges and a victim who loads the poisoned page, so it is not remotely triggerable by an unauthenticated attacker, and the resulting impact is confined to browser-context script execution with no server-side confidentiality or availability loss. Publicly available exploit code exists, the vendor was contacted but did not respond, the project follows a rolling-release model so no fixed version is identified, and no CISA KEV entry confirms active exploitation.
SQL injection in the editassid parameter of managevideos2.php in mathurvishal's CloudClassroom-PHP-Project lets an authenticated low-privilege user supply crafted input that is concatenated into a backend SQL query, allowing them to read from or modify the application's database. Publicly available exploit code exists (a proof-of-concept write-up is linked from the references), but there is no confirmed active exploitation in the wild and no CISA KEV listing; the provided CVSS 4.0 score is 2.1 and the independent re-assessment scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, treating it as a low real-world priority because valid credentials and a deployed instance of this niche, rolling-release PHP application are both required. The maintainer was contacted about the flaw and did not respond, and because the project ships as a rolling release there is no versioned affected or fixed release to point to.
SQL injection in the updatefaculty.php script of mathurvishal's CloudClassroom-PHP-Project allows remote attackers to inject arbitrary SQL through the unsanitized fid parameter, potentially reading or altering faculty records stored in the underlying database. Publicly available exploit code exists, published as a GitHub advisory with a SQLi proof-of-concept, and the vendor was contacted but never responded, so no fixed version is available; the CPE record (cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*) carries a wildcard version because the project uses a rolling-release model. Practical risk is bounded by the product's negligible production footprint as an obscure educational PHP project rather than by attack difficulty, making this a real but low-priority issue.
SQL injection in the updatestudent.php script of mathurvishal's CloudClassroom-PHP-Project lets an authenticated attacker inject arbitrary SQL through the unsanitized 'eno' parameter, allowing them to read or manipulate student records in the underlying database. The product is an unversioned educational PHP project hosted on GitHub, so all commits up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be are presumed affected and no fixed release exists. Publicly available exploit code exists (referenced from a GitHub repository alongside the VulDB entry), the vendor was contacted but never responded, and no CISA KEV entry indicates confirmed active exploitation.
SQL injection in mathurvishal's CloudClassroom-PHP-Project (updatequery.php) lets remote attackers manipulate the gid parameter to inject arbitrary SQL into the application's database queries, rated CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists via a GitHub advisory (proof-of-concept maturity per the E:P vector), but there is no CISA KEV listing and no evidence of active exploitation; CISA's SSVC assessment is Exploitation: poc, Automatable: yes, Technical Impact: partial. The vendor was contacted early and did not respond, and the project uses rolling releases, so no fixed version can be identified; combined with the product's near-zero deployment footprint, real-world risk is LOW.
SQL injection in the faculty authentication handler (loginlinkfaculty.php) of mathurvishal's CloudClassroom-PHP-Project lets unauthenticated remote attackers manipulate the fid or pass request arguments to alter the backend SQL query, potentially bypassing faculty login and reading or modifying application data. Exploitation needs only network reachability to the exposed login endpoint - the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with Low confidentiality, integrity, and availability impact (base 6.9), so no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists (a GitHub proof-of-concept demonstrating authentication bypass), but the practical risk is tempered by deployment scarcity: the vendor uses rolling releases, published no version details, responded to neither disclosure, and no vendor-released patch is currently identified.
SQL injection in CloudClassroom-PHP-Project's /postquerypublic.php endpoint allows unauthenticated remote attackers to manipulate the gnamex parameter and execute arbitrary database queries. Public exploit code is available for this vulnerability, and the vendor has not provided patches despite early disclosure notification. Affected systems using this PHP application up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are at immediate risk of data theft or manipulation.
SQL injection in CloudClassroom-PHP Project v1.0 exposes the application to remote, unauthenticated database manipulation via the `viewid` parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero prerequisites - any internet-accessible instance is directly exploitable without credentials. A publicly available proof-of-concept exists on GitHub, though EPSS at 0.31% (23rd percentile) indicates low observed exploitation probability at time of analysis, consistent with the obscure deployment footprint of this niche educational PHP application. No active exploitation is confirmed in CISA KEV.
CVE-2025-46179 is a critical SQL injection vulnerability in CloudClassroom-PHP Project v1.0's askquery.php file, where the 'squeryx' parameter is passed directly into SQL queries without sanitization. This affects all installations of CloudClassroom-PHP v1.0 and allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise including data exfiltration, modification, and denial of service. The vulnerability has a CVSS 9.8 score reflecting its network-based exploitability with no authentication or user interaction required; active exploitation status and POC availability are unknown from the provided data.
A remote code execution vulnerability in CloudClassroom-PHP-Project v1.0 (CVSS 9.8). Risk factors: public PoC available.
CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.
Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0, where the 'pass' parameter fails to properly validate user input, allowing unauthenticated attackers to inject arbitrary SQL queries over the network. This vulnerability can lead to confidentiality, integrity, and availability compromise with a CVSS score of 7.3 (High), though active exploitation status and proof-of-concept availability could not be verified from the provided data.
Time-based SQL injection vulnerability in the mydetailsstudent.php file of CloudClassroom PHP Project version 1.0, where the 'myds' parameter fails to properly validate user input, allowing unauthenticated remote attackers to inject and execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 (High), indicating potential for data theft, modification, and service disruption. No KEV status or active exploitation data is provided in the current intelligence; however, the network-accessible nature (CVSS:3.1/AV:N) and low attack complexity suggest this represents a significant real-world risk if the affected application is internet-facing.
A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessment function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.