CVE-2026-101013 mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched...

CVE-2026-101013 mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched...

EUVD-2026-88143

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched...

CVE-2026-101013

A security vulnerability exists in mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be ) involving a SQL injection flaw. The vulnerability is located within an unknown function in the updateresultdetails.php file, where manipulation of the editid argumen...

EUVD-2026-88142

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Roller 6.1.5 . The flaw is caused by CSRF validation filters incorrectly accepting requests that lack a required salt token , instead validating against a value the server itself generated for the request. This allows a remote att...

CVE-2026-82382 Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

EUVD-2026-88137

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

EUVD-2026-88133

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting ...

CVE-2026-82378

A critical Incorrect Authorization vulnerability exists in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 . The root cause is that the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. An unauthenticated remote attacker who...

CVE-2026-82378 Apache Roller: OAuth authorization endpoint trusts request-supplied identity

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting ...

EUVD-2026-88132

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit h...

CVE-2026-101012

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw is located within an unknown function in the makeresult.php file, where manipulation of the makeid argument allows for remote execution. Public exp...

CVE-2026-101012 mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit h...

EUVD-2026-88127

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...