Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121501mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation

Medium 6.3

In plain English

A medium-severity session fixation in CloudClassroom-PHP-Project from mathurvishal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 87.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
mathurvishal CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7bec46ce5736007d9d6e51a8feeb9250729fe85f139dae0c5961a35a4faf28cde9e02117538f09f81c1

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References