Vulnerability · Published Sep 25, 2026 · Assigned by VulDB

CVE-2026-97885mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection

High 7.3

In plain English

A high-severity SQL injection in CloudClassroom-PHP-Project from mathurvishal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
mathurvishal	CloudClassroom-PHP-Project	5dadec098bfbbf3300d60c3494db3fb95b66e7be

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-409904 | mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection vdb-entry, technical-description
VDB-409904 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-97885 | CVE Analysis and Report third-party-advisory
Submit #914564 | https://github.com/mathurvishal/CloudClassroom-PHP-Project.git CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be SQL Injection third-party-advisory
https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/blob/main/SQLi/ADVISORY.md exploit