Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

CloudClassroom-PHP-Project can let attackers inject malicious scripts

CVE-2026-100877 · published 21 days ago
Summary

The registration form in the CloudClassroom-PHP-Project does not properly clean the first name, last name and address fields that users submit. Because of that, a remote attacker could supply specially crafted data that runs unwanted code in the web browser of anyone who later views the page, potentially stealing information or altering what the page shows. Apply any available update for the project, or add server checks that remove or safely display unexpected characters before showing user‑provided data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mathurvishal cloudclassroom-php-project 5dadec098bfbbf3300d60c3494db3fb95b66e7be
Original advisory text
mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100877 · NVD
CVE-2026-100877 · MITRE
Track software like this
Free during beta