CVE-2026-120343

MediumCVSS 4.3/10Last modified Nov 2, 2026

Description

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

VendorProductVersions
mathurvishalCloudClassroom-PHP-Project5dadec098bfbbf3300d60c3494db3fb95b66e7be; c46ce5736007d9d6e51a8feeb9250729fe85f139; dae0c5961a35a4faf28cde9e02117538f09f81c1

References

Timeline

Published
Nov 2, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-12034410.0A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the CVE-2026-12034510.0A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the cCVE-2026-1203477.3A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the cCVE-2026-1203487.3A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file CVE-2026-1203497.3A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/wwwCVE-2026-120358.8Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruptionCVE-2026-1203505.1The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafCVE-2026-120367.1An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could alCVE-2026-1203646.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored CVE-2026-1203656.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area cCVE-2026-1203677.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, MoshCVE-2026-120375.5The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including
CVE-2026-120343: Medium severity, CVSS 4.3 | Vulnix