medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-120339

A cross‑site scripting (XSS) flaw exists in the CloudClassroom‑PHP‑Project’s updatedetailsfromfaculty.php file, allowing remote attackers to

Overview

A cross‑site scripting (XSS) flaw exists in the CloudClassroom‑PHP‑Project’s updatedetailsfromfaculty.php file, allowing remote attackers to inject malicious scripts via the fname parameter. The vulnerability is publicly known and could be exploited to steal user data or deface the site.

Description

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The XSS flaw can lead to theft of session cookies, credential compromise, or defacement, affecting confidentiality, integrity, and availability of user accounts. Defenders should monitor for anomalous script execution and protect user input.

Remediation

Apply the latest vendor patch once released. In the meantime, sanitize and validate the fname parameter, enforce strict output encoding, and implement a web application firewall rule to block script payloads.

Risk context

Severity is medium (CVSS 4.3/5.3) with no EPSS data. The flaw is publicly available, so defenders should treat it as a moderate risk that requires timely mitigation.

Affected products

  • mathurvishal CloudClassroom-PHP-Project

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

XSS Web Application Input Validation CloudClassroom PHP Medium Severity

← All CVEs

Related CVEs

medium

CVE-2026-120334

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

medium

CVE-2026-120343

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-120278

A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

View analysis

medium

CVE-2026-120309

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.

View analysis