Vulnerability · Published Apr 10, 2026 · Assigned by VulDB

CVE-2026-6010CodeAstro Online Classroom takeassessment2.php sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Online Classroom from CodeAstro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknown functionality of the file /OnlineClassroom/takeassessment2.php?exid=14. Performing a manipulation of the argument Q1 results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
CodeAstro	Online Classroom	1.02.php

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-356566 | CodeAstro Online Classroom takeassessment2.php sql injection vdb-entry, technical-description
VDB-356566 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #794658 | codeastro Online Classroom V1.0 SQL Injection third-party-advisory
https://github.com/xue-p123/vuldb-research/issues/2 exploit, issue-tracking
https://codeastro.com/ product