Description
A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-27
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Missing Authentication leading to unauthorized student access
Action: Assess Impact
AI Analysis

Impact

A vulnerability in the loginlinkstudent.php file of the CloudClassroom-PHP-Project allows an attacker to manipulate the "umail" argument and bypass authentication. The flaw results in missing authentication checks, enabling remote exploitation without needing valid credentials. This can compromise the confidentiality and integrity of student data and potentially allow other privileged actions within the application.

Affected Systems

The affected product is mathurvishal CloudClassroom-PHP-Project, specifically versions up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No exact release or patch information is available due to the product’s rolling‑release model, and the vendor has not responded to the disclosure.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, involving crafted HTTP requests that alter the "umail" parameter to circumvent login checks. Given the lack of a current fix, the risk remains until a vendor patch or mitigation is applied.

Generated by OpenCVE AI on September 27, 2026 at 21:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch or update as soon as one becomes available.
  • Restrict direct access to loginlinkstudent.php by configuring the web server to allow requests only from trusted IP ranges or require additional authentication.
  • Implement server‑side validation or sanitization for the "umail" parameter to ensure it contains only legitimate student identifiers and reject malformed inputs.
  • Monitor web application logs for repeated attempts to access loginlinkstudent.php with manipulated parameters and investigate suspicious activity.

Generated by OpenCVE AI on September 27, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-27T19:45:08.814Z

Reserved: 2026-09-27T03:27:47.296Z

Link: CVE-2026-100876

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-27T20:16:48.960

Modified: 2026-09-27T20:16:48.960

Link: CVE-2026-100876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T21:30:18Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function