An input validation flaw in the Faculty Video Management component of mathurvishal CloudClassroom‑PHP‑Project allows attackers to inject arbitrary JavaScript via the V_Title, V_Url, or V_Remarks parameters. The vulnerability is a classic reflected XSS, corresponding to CWE‑79, and the code may also spawn unintended PHP execution paths as indicated by CWE‑94. Successful exploitation could lead to cookie theft, session hijacking, or malicious content injection for any user who views the affected page.

The flaw exists in mathurvishal CloudClassroom‑PHP‑Project, impacting all releases up to and including the commit hash 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No specific version numbers are disclosed due to the project’s rolling release model, so any instance that has not been verified as newer than the stated commit is potentially vulnerable.

The CVSS score of 5.1 places the vulnerability in the moderate range, and the public availability of an exploit and the ability for remote exploitation elevate the practical risk. Although the EPSS score is not available, the lack of a KEV listing does not diminish the likelihood that an attacker could exploit the site. The attack can be performed by any remote user able to send crafted requests to the vulnerable script, making the risk high for unpatched deployments.