# CVE-2026-120343: mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- mathurvishal / CloudClassroom-PHP-Project: 5dadec098bfbbf3300d60c3494db3fb95b66e7be (affected); c46ce5736007d9d6e51a8feeb9250729fe85f139 (affected); dae0c5961a35a4faf28cde9e02117538f09f81c1 (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 5.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P; source: CNA: VulDB

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 3.0: 4.3 (medium); CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 2.0: 5 (medium); AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C; source: CNA: VulDB

- CVSS 4.0: 2.1 (low); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; source: NVD: cna@vuldb.com

- CVSS 2.0: 5 (medium); AV:N/AC:L/Au:N/C:N/I:P/A:N; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79, CWE-94

## Exploit evidence

- exploit: https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md (CNA: VulDB)

## References

- https://vuldb.com/vuln/429668 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/429668/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-120343 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1017562 (CNA: VulDB; third-party-advisory)

- https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md (CNA: VulDB; exploit)

- https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120343 (cna@vuldb.com)

- https://vuldb.com/submit/1017562 (cna@vuldb.com)

- https://vuldb.com/vuln/429668 (cna@vuldb.com)

- https://vuldb.com/vuln/429668/cti (cna@vuldb.com)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-120343; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120343; retrieved 2026-11-02; source updated 2026-11-02

Revision: e4b8fbcfb54d6b624b48d9a9cc4a468b44a47bb2717f6b46392eda84be221f41

Canonical: https://y2.dev/cve/CVE-2026-120343