# CVE-2026-120343: CloudClassroom-PHP-Project stored cross-site scripting in assessment management

Source: https://junglewise.ai/threats/cve-2026-120343-a-flaw-has-been-found-in-mathurvishal-cloudclassroom-php-project  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120343 · Severity: medium · CVSS 4.3 · Published 2026-11-02

CloudClassroom-PHP-Project is a web application for managing online classroom assessments and exams. An unauthenticated attacker can inject malicious JavaScript into assessment questions that executes when faculty members or students view the affected assessment, allowing the attacker to steal data, modify grades, or impersonate users. The vulnerability remains unfixed and exploits are publicly available.

Technologies: [Mathurvishal CloudClassroom PHP Project](https://junglewise.ai/threats/technologies/mathurvishal-cloudclassroom-php-project). Vendors: [Mathurvishal](https://junglewise.ai/threats/vendors/mathurvishal).

## Quick answers

**Is CVE-2026-120343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120343 being exploited in the wild.

**How severe is CVE-2026-120343?** Medium severity, with a CVSS score of 4.3, published 2 November 2026.

**Which products and versions are affected?** mathurvishal CloudClassroom-PHP-Project.

**Is there a fix for CVE-2026-120343?** No fixed version is recorded yet. Add exit() or die() immediately after the Location header to terminate execution of unauthenticated requests, use prepared statements with parameterized queries to prevent injection, and apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) to all database values before rendering in HTML context. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120343 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120343?** Check whether you run Mathurvishal CloudClassroom PHP Project. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Add exit() or die() immediately after the Location header to terminate execution of unauthenticated requests, use prepared statements with parameterized queries to prevent injection, and apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) to all database values before rendering in HTML context.

## Technical details

A stored cross-site scripting vulnerability exists in manageassessment2.php where assessment fields (ExamName, Q1-Q5) are directly persisted to the database without sanitization and later rendered without HTML encoding. The vulnerability chains an ineffective authentication redirect that does not terminate execution with unsafe input handling and unsafe output rendering, allowing unauthenticated POST requests to inject arbitrary JavaScript that executes in authenticated users' browsers.

## Affected products

- mathurvishal CloudClassroom-PHP-Project

## Timeline

- 2026-11-02: disclosed: Advisory published; no vendor response received despite early notification

## References

- [https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md](https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md)
- [https://vuldb.com/cve/CVE-2026-120343](https://vuldb.com/cve/CVE-2026-120343)

## Related threats

- [mathurvishal CloudClassroom-PHP-Project SQL injection in facultydetails.php](https://junglewise.ai/threats/cve-2026-121502-a-vulnerability-was-identified-in-mathurvishal-cloudclassroom)
- [mathurvishal CloudClassroom-PHP-Project session fixation in login](https://junglewise.ai/threats/cve-2026-121501-a-vulnerability-was-determined-in-mathurvishal-cloudclassroom)
- [mathurvishal CloudClassroom-PHP-Project SQL injection in viewquery.php](https://junglewise.ai/threats/cve-2026-120342-a-vulnerability-was-detected-in-mathurvishal-cloudclassroom-php)
- [mathurvishal CloudClassroom-PHP-Project open redirect in studentdetails.php](https://junglewise.ai/threats/cve-2026-120341-a-security-vulnerability-has-been-detected-in-mathurvishal)
- [mathurvishal CloudClassroom-PHP-Project cross-site scripting in updatedetailsfromfaculty.php](https://junglewise.ai/threats/cve-2026-120339-a-security-flaw-has-been-discovered-in-mathurvishal)