CVE-2026-100311
Received Received - Intake

Stored XSS in CloudClassroom PHP Project Faculty Video Management

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulDB

Description
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100311
EUVD
EUVD-2026-87543

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mathurvishal cloudclassroom_php_project to 1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (Stored XSS) vulnerability in the CloudClassroom PHP Project. It affects the managevideos2.php file where user input from V_Title, V_Url, and V_Remarks parameters is stored in the database and rendered back without proper encoding. An attacker can inject malicious scripts that execute when the page is viewed.

Detection Guidance

To detect this vulnerability, inspect the managevideos2.php file for unsanitized user input in V_Title, V_Url, and V_Remarks parameters. Check if these inputs are directly echoed without encoding. Use browser developer tools to monitor network requests and responses for suspicious payloads. Test by injecting simple XSS payloads like <script>alert(1)</script> into these fields and verify if the script executes when the page reloads.

Commands to check for vulnerable endpoints include searching for managevideos2.php in your web server logs or file system. Use grep to find instances of unsanitized echo statements in PHP files: grep -r "echo.*V_Title\|echo.*V_Url\|echo.*V_Remarks" /path/to/project.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript, steal sessions, take over accounts, perform phishing attacks, or deface the application. The impact includes persistent client-side code execution and potential data theft.

Compliance Impact

Stored XSS can lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Both standards require safeguards against such attacks.

Mitigation Strategies

Immediately update the CloudClassroom PHP Project to the latest version if available. If not, apply input validation to sanitize V_Title, V_Url, and V_Remarks parameters on the server side. Use htmlspecialchars() to encode output before rendering. Implement a Content Security Policy (CSP) to restrict inline scripts and external resources. Consider using a library like HTML Purifier to sanitize HTML input if rich text editing is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart