CVE-2025-46178

EPSS 0.03%
Veröffentlicht 09.06.2025 00:00:00
Zuletzt bearbeitet 02.07.2025 17:50:32
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Vishalmathur ≫ Cloudclassroom-php Project Version1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.08

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/SacX-7/CVE-2025-46178/blob/main/Cross-Site%20Scripting%20%28XSS%29%20in%20CloudClassroom%20PHP%20Project

Third Party Advisory

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2025-46178

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-46178

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-46178

EUVD