Reported by 5 outlets

CloudClassroom-PHP-Project vulnerabilities: CVE-2026-100874 SQL injection

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 5 sources
Authority: 1.00 / 2.0 · best outlet weight
Severity: 1.70 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.00 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

cve.orgexploit-db.comgithub.comcisa.goveuvd.enisa.europa.eu CVE-2026-100874 desk first seen 16d ago

Desk analysis

CVE-2026-100874 is unauthenticated SQL injection in addnewstudent.php of mathurvishal's CloudClassroom-PHP-Project, tracked against every copy up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. VulDB assigned it on September 27, 2026 at 7.3 CVSS v3.1 and 6.9 CVSS v4.0 with the exploit already published, crediting reporter vinniboy021 through submission 915272, and the record states the vendor was contacted early and did not respond in any way. It is not the product's only open flaw: the same CNA published five sibling SQL injection CVEs on September 25 (CVE-2026-97882 through 97886, covering loginlinkfaculty.php, updatequery.php, updatestudent.php, updatefaculty.php and managevideos2.php) and two more on September 26 (CVE-2026-100312, CVE-2026-100315), while ENISA's EUVD feed logged EUVD-2026-88006 at 5.3 and EUVD-2026-88008 and EUVD-2026-88009 at 6.9 the same day.

The signal here is the assembly line, not any single record. Eight CVEs landed in three days, on top of a year-long public history: EDB-52314 has carried a working time-based blind PoC for CVE-2025-45542 since June 5, 2025, CVE-2025-46179 in askquery.php has been rated 9.8 since June 20, 2025, and CVE-2026-2058 in postquerypublic.php was already in CISA's weekly vulnerability summary on February 9, 2026. Every record marks the exploit public, the project uses a rolling release model with no fixed version, so no update exists to deploy, and the EDB entry ships the Google dork inurl:CloudClassroom-PHP-Project-master that makes school deployments findable at scale. For any site running this app, one SQL injection means the entire backend database, student and faculty records included, is readable, and the parameter churn shows the codebase has no systematic input handling, so remediating a single endpoint purchases nothing.

There is no patched release to install. Treat any internet-facing instance as an incident: take it offline or restrict it to trusted campus ranges at the firewall. Hunt in web access logs for SQL syntax in the parameters these records name, pass, squeryx, gnamex, gname, myfid, fid, eno and editassid, reaching registrationform, addnewstudent.php, askquery.php, postquerypublic.php, mydetailsfaculty.php, updatefaculty.php, updatestudent.php, updateguest.php and managevideos2.php; the published PoC pattern XOR(if(now()=sysdate(),sleep(6),0)) shows up as repeated requests to one URL with response times clustering around six seconds. Any hit means assume database compromise: rotate the application's database credentials, review student and faculty tables for bulk reads, and check for rows inserted into privilege tables.

Two developments would change the assessment. CISA KEV listing or mass-scanner telemetry for any of the eight CVEs would move this from background noise to an active campaign, and VulDB already operates CTI indicator pages for VDB-410804. A first-ever vendor response, or a hardened fork replacing the master branch, would be the only durable fix; the researcher's own advisory file for addnewstudent.php has since been deleted from their GitHub repository, so fuller details may resurface elsewhere.

Timeline

original reporting

CVE-2026-100874 is a remotely exploitable SQL injection vulnerability in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A

www.cve.org · 16d ago · September 27th, 2026

CVE-2026-100874 is a remotely exploitable SQL injection vulnerability in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A

via Mastodon https://www.cve.org/CVERecord?id=CVE-2026-100874
update from exploit-db.com

CloudClassroom PHP Project 1.0 - SQL Injection (EDB-52314, CVE-2025-45542)

exploit-db.com · 496d ago · June 5th, 2025

OffSec's Exploit-DB entry EDB-52314, authored by Sanjay Singh and dated June 5, 2025, publishes a working time-based blind SQL injection PoC for CloudClassroom PHP Project 1.0, CVE-2025-45542. The PoC sends a POST to the registrationform endpoint with the pass parameter set to XOR(if(now()=sysdate(),sleep(6),0)) and infers data from response delays. The entry includes the Google dork inurl:CloudClassroom-PHP-Project-master for locating live deployments and was tested on XAMPP under Windows 10 and Ubuntu 22.04.
update from github.com

GHSA-3539-3c95-mf2j: CVE-2025-46179 SQL injection in askquery.php

github.com · 481d ago · June 20th, 2025

The GitHub Advisory Database entry for CVE-2025-46179, published June 20, 2025 by the National Vulnerability Database, describes SQL injection in the askquery.php file of CloudClassroom-PHP Project v1.0, where the squeryx parameter accepts unsanitized input passed directly into backend SQL queries. It is rated Critical 9.8 under CVSS 3.1 (CWE-89) and carries an EPSS of 0.591 percent. The advisory references a researcher disclosure on Pastebin.
update from github.com

carlosalbertotuma/CLOUD-CLASSROOMS-php-1.0 PoC repository

github.com · 450d ago · July 20th, 2025

GitHub records this repository, cited by VulDB as the public PoC and Impact write-up for CVE-2026-2058 in CloudClassroom-PHP-Project, as created on July 20, 2025. It continued receiving pushes through March 2, 2026. The repository's existence shows working exploit code for the product circulating publicly well before the CVE-2026-100874 record.
update from cve.org

CVE-2026-2058: CloudClassroom-PHP-Project postquerypublic.php sql injection

cve.org · 249d ago · February 6th, 2026

The CVE record for CVE-2026-2058 (VulDB VDB-344618), published February 6, 2026, describes SQL injection in /postquerypublic.php of CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be via the gnamex argument, rated 7.3 on CVSS v3.1 with the exploit already published. It is the earliest tracked entry of the 2026 disclosure wave in the same product, seven months before CVE-2026-100874.
update from cisa.gov

CISA Vulnerability Summary for the Week of February 2, 2026

cisa.gov · 247d ago · February 9th, 2026

CISA's weekly vulnerability summary for the week of February 2, 2026 lists mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection (VDB-344618, CVE-2026-2058) among that week's published vulnerabilities. A federal bulletin therefore flagged the product as carrying a publicly exploitable SQL injection months before the CVE-2026-100874 record appeared.
update from cve.org

CVE-2026-97886: CloudClassroom-PHP-Project managevideos2.php sql injection

cve.org · 18d ago · September 25th, 2026

It is one of five records (CVE-2026-97882 through 97886) reserved in a single batch at 09:05 UTC that morning and published at fifteen-minute intervals, two days before CVE-2026-100874.
update from euvd.enisa.europa.eu

🚨 EUVD-2026-88006 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: CloudClassroom-PHP-Project 🏢 Vendor: mathurvishal 📅 Updated: 2026-09-27 📝 A vulnera

euvd.enisa.europa.eu · 16d ago · September 27th, 2026

🚨 EUVD-2026-88006 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: CloudClassroom-PHP-Project 🏢 Vendor: mathurvishal 📅 Updated: 2026-09-27 📝 A vulnera

via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88006
mentioned by euvd.enisa.europa.eu

🚨 EUVD-2026-88009 📊 Score: 6.9/10 (CVSS v3.1) 📦 Product: CloudClassroom-PHP-Project 🏢 Vendor: mathurvishal 📅 Updated: 2026-09-27 📝 A vulnera

euvd.enisa.europa.eu · 16d ago · September 27th, 2026
mentioned by euvd.enisa.europa.eu

🚨 EUVD-2026-88008 📊 Score: 6.9/10 (CVSS v3.1) 📦 Product: CloudClassroom-PHP-Project 🏢 Vendor: mathurvishal 📅 Updated: 2026-09-27 📝 A flaw ha

euvd.enisa.europa.eu · 16d ago · September 27th, 2026