CVE-2025-26199

CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability

Critical · published June 18, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

🚨 An unsecured login process in CloudClassroom-PHP-Project v1.0 means passwords are flying through the air like confetti at a parade! 🎉 Think of it like sending a postcard through the mail—anyone can read the message before it reaches its destination, leaving your secrets wide open to snoopers. In this case, attackers on the same network can easily intercept your credentials with the right tricks. If an attacker grabs your login credentials, they can stroll right into your account and perform malicious actions, potentially even execute harmful code. This could lead to catastrophic data breaches or unauthorized access to sensitive information—your digital life could be at stake!

Put simply

Think of it like sending a postcard through the mail—anyone can read the message before it reaches its destination, leaving your secrets wide open to snoopers. In this case, attackers on the same network can easily intercept your credentials with the right tricks. This vulnerability arises because CloudClassroom transmits passwords over unencrypted HTTP, making them vulnerable to interception through Man-in-the-Middle (MitM) attacks. This allows attackers on the same network to capture sensitive login credentials before they reach their intended destination.

What to do

If an attacker grabs your login credentials, they can stroll right into your account and perform malicious actions, potentially even execute harmful code. This could lead to catastrophic data breaches or unauthorized access to sensitive information—your digital life could be at stake! Upgrade to a version that supports HTTPS to encrypt your login credentials in transit. Additionally, ensure to implement secure coding practices to protect against potential exploitation of admin functions. Review your network security policies to safeguard against sniffing attacks. You can tackle this! Secure your application now and keep those credentials safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00570 · 46.4th percentile
Published
2025-06-18T00:00Z
EPSS history
Timeline
  • 18 JUN 00:00Z
    CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability
    cvelistv5