A stored cross‑site scripting vulnerability resides in the addnewstudent.php component of CloudClassroom‑PHP‑Project. Manipulating the fname parameter allows an attacker to inject arbitrary script code that executes in the context of a victim’s browser. This flaw can lead to session hijacking, credential theft, defacement, or injection of malware, thereby compromising the confidentiality, integrity, and availability of user data.

The affected product is CloudClassroom‑PHP‑Project, a web‑based learning platform. The vendor places the project on a rolling‑release schedule and does not publish individual version numbers, so it is unclear which exact code iterations contain the flaw. Nonetheless, any deployed instance that has not been patched for the XSS issue is susceptible.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is not available, but the vulnerability is publicly disclosed and can be exploited remotely without local user interaction. It is not listed in the CISA KEV catalogue, and no patch is currently supplied. An attacker can simply send a malicious request to the addnewstudent.php endpoint to inject script content that will be stored and later served to other users.