Is CVE-2026-100311 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100311 being exploited in the wild.

How severe is CVE-2026-100311?

Low severity, with a CVSS score of 3.5, published 26 September 2026.

Which products and versions are affected?

mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be.

Is there a fix for CVE-2026-100311?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100311 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100311?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100311: mathurvishal CloudClassroom-PHP-Project stored cross-site scripting in Faculty Video Management

CVE-2026-100311 · Severity: low · CVSS 3.5 · Published 2026-09-26

CloudClassroom-PHP-Project is a web-based classroom management system that allows faculty to upload and manage video content. A vulnerability in the Faculty Video Management component fails to properly sanitize user input, allowing authenticated attackers to inject malicious JavaScript code that executes when other users view the affected pages. This could enable attackers to steal session cookies, impersonate users, or deface course materials.

Quick answers

Is CVE-2026-100311 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100311 being exploited in the wild.
How severe is CVE-2026-100311?: Low severity, with a CVSS score of 3.5, published 26 September 2026.
Which products and versions are affected?: mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be.
Is there a fix for CVE-2026-100311?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100311 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100311?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in managevideos2.php, affecting the Faculty Video Management component. User-controlled input from the V_Title, V_Url, and V_Remarks parameters is stored in the database and rendered to the browser without proper HTML encoding or sanitization. An authenticated attacker can inject arbitrary JavaScript by breaking out of the textarea context (e.g., via </textarea><script>alert(1)</script>), which persists in the database and executes in the browsers of all users who view the affected page. The vulnerability requires authentication but allows session hijacking, account takeover, and defacement. The vendor uses a rolling release system and has not responded to disclosure attempts.

Affected products

mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be

Timeline

2026-09-26: disclosed: CVE-2026-100311 published
2026-09-26: other: Exploit code publicly available on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.