Description
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-03
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote Session Fixation
Action: Patch
AI Analysis

Impact

The vulnerability allows an attacker to manipulate the PHPSESSID argument through the session_regenerate_id function in loginlinkadmin.php, leading to session fixation. This flaw could enable a remote adversary to hijack user sessions and potentially gain unauthorized access to privileged data or functions within the CloudClassroom-PHP-Project application. The weakness is captured by CWE-384, reflecting improper handling of session regeneration.

Affected Systems

The affected product is CloudClassroom-PHP-Project by mathurvishal. No versioning information is available for the product, so all deployments are considered potentially impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity risk. Because the EPSS score is not available, the current exploitation probability cannot be precisely quantified, but the vulnerability is publicly disclosed and may be used remotely. The product is not listed in the CISA KEV catalog. The attack can be launched remotely via manipulation of session identifiers, and the fixation may allow session hijacking if not mitigated.

Generated by OpenCVE AI on November 3, 2026 at 20:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available patch or update from the vendor that corrects the session regeneration flow.
  • If no patch exists, modify the application to regenerate sessions properly by calling session_regenerate_id(true) and clearing the previous session data before assigning new identifiers.
  • Enforce secure attributes on session cookies, such as HttpOnly, Secure, and SameSite, to reduce the likelihood of session fixation.

Generated by OpenCVE AI on November 3, 2026 at 20:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 19:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-384
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-03T19:00:21.523Z

Reserved: 2026-11-03T14:16:04.130Z

Link: CVE-2026-121501

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-03T19:18:04.083

Modified: 2026-11-03T19:18:04.270

Link: CVE-2026-121501

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T20:45:01Z

Weaknesses