Is CVE-2026-5578 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5578 being exploited in the wild.

How severe is CVE-2026-5578?

Medium severity, with a CVSS score of 6.3, published 5 April 2026.

Is there a fix for CVE-2026-5578?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5578 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-5578?

Check whether you run CodeAstro Online Classroom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5578: CodeAstro Online Classroom SQL injection in deleteid parameter

CVE-2026-5578 · Severity: medium · CVSS 6.3 · Published 2026-04-05

CodeAstro Online Classroom, a web-based educational platform, contains a security vulnerability that could allow an attacker to access or modify its underlying database. By sending specially crafted requests to the assessment management component, an attacker can bypass security controls to view sensitive student information or disrupt classroom operations. This issue stems from how the software handles specific database commands, potentially leading to unauthorized data access or loss of system integrity.

Technologies: CodeAstro Online Classroom. Vendors: CodeAstro.

Quick answers

Is CVE-2026-5578 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5578 being exploited in the wild.
How severe is CVE-2026-5578?: Medium severity, with a CVSS score of 6.3, published 5 April 2026.
Which products and versions are affected?: CodeAstro Online Classroom 1.0.
Is there a fix for CVE-2026-5578?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5578 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-5578?: Check whether you run CodeAstro Online Classroom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the 'Parameter Handler' component. The issue is located in /OnlineClassroom/addassessment.php (and reportedly /OnlineClassroom/resultdetails.php) where the 'deleteid' GET parameter is used in a SQL query without sufficient sanitization or use of prepared statements. An authenticated attacker with network access can exploit this via boolean-based, error-based, or time-based blind injection techniques. Successful exploitation allows for unauthorized database access, data tampering, and potential leakage of sensitive information. A public proof-of-concept (PoC) using sqlmap has been disclosed.

Affected products

CodeAstro Online Classroom 1.0

Timeline

2026-03-20: disclosed: Initial discovery and PoC shared on GitHub
2026-04-05: advisory: Vulnerability published by VulDB and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.