The vulnerability is a stored cross‑site scripting flaw located in the updatedetailsfromfaculty.php script. Manipulating the fname argument allows an attacker to inject arbitrary JavaScript that will be executed in the context of any user who views the resulting page. Because the script runs with the privileges of the victim’s browser session, it can deface content, steal session cookies, or conduct further phishing or credential‑stealing attacks.

The affected product is mathurvishal:CloudClassroom‑PHP‑Project. At the time of this advisory, no specific version numbers are listed because the project uses a rolling release model, so any recent deployment may be vulnerable until a fix is applied.

The CVSS score of 5.3 indicates a moderate severity impact. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. However, the public exploit has been released and the attack can be performed remotely by submitting a crafted fname value. If an attacker elects to exploit this flaw, they can execute arbitrary client‑side code in the browser context of any authenticated or unauthenticated user who accesses the affected page.