CVE-2026-120339
Received Received - Intake

Cross-Site Scripting in CloudClassroom PHP Project via fname Parameter

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120339

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mathurvishal CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be
mathurvishal CloudClassroom-PHP-Project c46ce5736007d9d6e51a8feeb9250729fe85f139
mathurvishal CloudClassroom-PHP-Project dae0c5961a35a4faf28cde9e02117538f09f81c1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in mathurvishal CloudClassroom-PHP-Project. It exists in the file updatedetailsfromfaculty.php where the fname argument can be manipulated to execute malicious scripts. The attack can be performed remotely and a public exploit is available.

Detection Guidance

Detecting this XSS vulnerability requires checking for improper input handling in updatedetailsfromfaculty.php. Inspect web server logs for unusual requests containing script tags or fname parameter manipulation. Use tools like Burp Suite or OWASP ZAP to fuzz the fname parameter for XSS payloads. Review application code for unsanitized user input in fname handling.

Impact Analysis

This XSS vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. This may lead to theft of session cookies, account hijacking, or defacement of the website. Users could unknowingly execute harmful code while interacting with the affected application.

Mitigation Strategies

Immediately apply input validation and output encoding to the fname parameter in updatedetailsfromfaculty.php. Implement Content Security Policy headers to mitigate XSS impact. Update to the latest version if available. Monitor network traffic for exploitation attempts. Consider disabling the application if no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...