CVE-2026-116097: CloudClassroom-PHP-Project addnewstudent.php cross site scripting
A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can launch the attack remotely without privileges, but exploitation requires user interaction. The vulnerable input is the fname argument in addnewstudent.php.
Are fixed or affected versions available?
No version-specific affected or updated release information is available because the product uses a rolling release model. The vendor did not respond to the disclosure.
How likely is exploitation in practice?
A public exploit disclosure exists and may be used. Successful exploitation is limited to cross-site scripting impacts, with integrity impact rated low and no reported confidentiality or availability impact.