CVE-2025-50866

CloudClassroom-PHP-Project 1.0 is vulnerable to a reflected Cross-site Scripting (XSS) flaw within the email parameter of the postquerypublic endpoint. The root cause is improper sanitization of user-supplied input, which allows an attacker to inject and execute arbitrary JavaScript code in a vic...

CVE-2025-50867

A SQL Injection vulnerability exists in the takeassessment2.php endpoint of CloudClassroom-PHP-Project 1.0 . The flaw is caused by the Q5 POST parameter being directly embedded into SQL statements without proper sanitization. An attacker can exploit this by sending a malicious POST request contai...