The vulnerability resides in the manageassessment2.php module of the CloudClassroom‑PHP‑Project, where the server fails to properly sanitize user‑supplied arguments such as ExamName, Q1, Q2, Q3, Q4, and Q5. This flaw allows an attacker to inject arbitrary script payloads that are stored and later rendered in victim browsers, enabling arbitrary JavaScript execution, session hijacking, or data theft. The weakness is classified as a stored XSS (CWE‑79) possibly combined with code injection (CWE‑94).

The only known affected product is mathurvishal’s CloudClassroom‑PHP‑Project. Because the project follows a rolling release strategy, no specific version identifiers are available, so any current or future release may be impacted until a fix is applied.

The base CVSS score of 5.3 denotes a moderate severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by crafting HTTP requests that submit malicious payloads to the manageassessment2.php script. Successful exploitation could compromise the confidentiality and integrity of user data for all users who view the rendered content.