Vulnerability · Published Nov 2, 2026 · Assigned by VulDB

CVE-2026-120342mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

High 7.3

In plain English

A high-severity SQL injection in CloudClassroom-PHP-Project from mathurvishal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
mathurvishal	CloudClassroom-PHP-Project	5dadec098bfbbf3300d60c3494db3fb95b66e7bec46ce5736007d9d6e51a8feeb9250729fe85f139dae0c5961a35a4faf28cde9e02117538f09f81c1

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-429667 | mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection vdb-entry, technical-description
VDB-429667 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-120342 | CVE Analysis and Report third-party-advisory
Submit #1016422 | mathurvishal CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be SQL Injection (UNION-based / error-based) third-party-advisory
https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/tree/main/viewquery-sqli exploit