A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...

zetlyn/cve-ghsa vulnerability ghsa GHSA-c77p-prh2-xw6x cve CVE-2026-100894 known 2026-09-28

https://github.com/advisories/GHSA-c77p-prh2-xw6x

Properties

cvss

cvss	6.3 receipt Source GitHub advisories Its words `6.3` Read by `field:cvss.score` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100894", "cvss": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 2.1, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" } ], "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.", "epss": { "percentage": 0.00303, "percentile": 0.20669 }, "ghsa_id": "GHSA-c77p-prh2-xw6x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x", "identifiers": [ { "type": "GHSA", "value": "GHSA-c77p-prh2-xw6x" }, { "type": "CVE", "value": "CVE-2026-100894" } ], "nvd_published_at": "2026-09-28T02:17:19Z", "published_at": "2026-09-28T03:30:26Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-100894", "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git", "https://vuldb.com/cve/CVE-2026-100894", "https://vuldb.com/submit/917723", "https://vuldb.com/vuln/410844", "https://vuldb.com/vuln/410844/cti", "https://github.com/advisories/GHSA-c77p-prh2-xw6x" ], "repository_advisory_url": null, "severity": "low", "source_code_location": "", "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...", "type": "unreviewed", "updated_at": "2026-09-28T03:30:33Z", "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x", "vulnerabilities": [], "withdrawn_at": null }
cwe	CWE-74 receipt Source GitHub advisories Its words `CWE-74` Read by `field:cwes[].cwe_id` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100894", "cvss": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 2.1, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" } ], "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.", "epss": { "percentage": 0.00303, "percentile": 0.20669 }, "ghsa_id": "GHSA-c77p-prh2-xw6x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x", "identifiers": [ { "type": "GHSA", "value": "GHSA-c77p-prh2-xw6x" }, { "type": "CVE", "value": "CVE-2026-100894" } ], "nvd_published_at": "2026-09-28T02:17:19Z", "published_at": "2026-09-28T03:30:26Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-100894", "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git", "https://vuldb.com/cve/CVE-2026-100894", "https://vuldb.com/submit/917723", "https://vuldb.com/vuln/410844", "https://vuldb.com/vuln/410844/cti", "https://github.com/advisories/GHSA-c77p-prh2-xw6x" ], "repository_advisory_url": null, "severity": "low", "source_code_location": "", "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...", "type": "unreviewed", "updated_at": "2026-09-28T03:30:33Z", "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x", "vulnerabilities": [], "withdrawn_at": null }
severity	low Below 4.0. receipt Source GitHub advisories Its words `low` Read by `field:severity` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100894", "cvss": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 6.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 2.1, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" } ], "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.", "epss": { "percentage": 0.00303, "percentile": 0.20669 }, "ghsa_id": "GHSA-c77p-prh2-xw6x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x", "identifiers": [ { "type": "GHSA", "value": "GHSA-c77p-prh2-xw6x" }, { "type": "CVE", "value": "CVE-2026-100894" } ], "nvd_published_at": "2026-09-28T02:17:19Z", "published_at": "2026-09-28T03:30:26Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-100894", "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git", "https://vuldb.com/cve/CVE-2026-100894", "https://vuldb.com/submit/917723", "https://vuldb.com/vuln/410844", "https://vuldb.com/vuln/410844/cti", "https://github.com/advisories/GHSA-c77p-prh2-xw6x" ], "repository_advisory_url": null, "severity": "low", "source_code_location": "", "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...", "type": "unreviewed", "updated_at": "2026-09-28T03:30:33Z", "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x", "vulnerabilities": [], "withdrawn_at": null }

6.3

receipt

Source: GitHub advisories
Its words: 6.3
Read by: field:cvss.score
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100894",
  "cvss": {
    "score": 6.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 2.1,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.00303,
    "percentile": 0.20669
  },
  "ghsa_id": "GHSA-c77p-prh2-xw6x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c77p-prh2-xw6x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100894"
    }
  ],
  "nvd_published_at": "2026-09-28T02:17:19Z",
  "published_at": "2026-09-28T03:30:26Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100894",
    "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git",
    "https://vuldb.com/cve/CVE-2026-100894",
    "https://vuldb.com/submit/917723",
    "https://vuldb.com/vuln/410844",
    "https://vuldb.com/vuln/410844/cti",
    "https://github.com/advisories/GHSA-c77p-prh2-xw6x"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T03:30:33Z",
  "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

cwe

CWE-74

receipt

Source: GitHub advisories
Its words: CWE-74
Read by: field:cwes[].cwe_id
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100894",
  "cvss": {
    "score": 6.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 2.1,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.00303,
    "percentile": 0.20669
  },
  "ghsa_id": "GHSA-c77p-prh2-xw6x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c77p-prh2-xw6x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100894"
    }
  ],
  "nvd_published_at": "2026-09-28T02:17:19Z",
  "published_at": "2026-09-28T03:30:26Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100894",
    "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git",
    "https://vuldb.com/cve/CVE-2026-100894",
    "https://vuldb.com/submit/917723",
    "https://vuldb.com/vuln/410844",
    "https://vuldb.com/vuln/410844/cti",
    "https://github.com/advisories/GHSA-c77p-prh2-xw6x"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T03:30:33Z",
  "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

low

Below 4.0.

receipt

Source: GitHub advisories
Its words: low
Read by: field:severity
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100894",
  "cvss": {
    "score": 6.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 2.1,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.00303,
    "percentile": 0.20669
  },
  "ghsa_id": "GHSA-c77p-prh2-xw6x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c77p-prh2-xw6x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c77p-prh2-xw6x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100894"
    }
  ],
  "nvd_published_at": "2026-09-28T02:17:19Z",
  "published_at": "2026-09-28T03:30:26Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100894",
    "https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git",
    "https://vuldb.com/cve/CVE-2026-100894",
    "https://vuldb.com/submit/917723",
    "https://vuldb.com/vuln/410844",
    "https://vuldb.com/vuln/410844/cti",
    "https://github.com/advisories/GHSA-c77p-prh2-xw6x"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T03:30:33Z",
  "url": "https://api.github.com/advisories/GHSA-c77p-prh2-xw6x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to... A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.