CVE-2025-26199

CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.

• CWE-319

• https://gist.github.com/tansique-17/6e01bb1b8a09ef499a9b8484a8dc2487Exploit, Third Party Advisory
• https://github.com/tansique-17/CVE-2025-26199/tree/mainExploit, Third Party Advisory

Published

Jun 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2617A vulnerability classified as problematic was found in yangy…4.8
• CVE-2025-2618A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-26182An issue in xxyopen novel plus v.4.4.0 and before allows a r…6.5
• CVE-2025-26186SQL Injection vulnerability in openSIS v.9.1 allows a remote…8.1
• CVE-2025-2619A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-26198CloudClassroom-PHP-Project v1.0 contains a critical SQL Inje…9.8
• CVE-2025-2620A vulnerability has been found in D-Link DAP-1620 1.03 and c…9.8
• CVE-2025-26200SQL injection in SLIMS v.9.6.1 allows a remote attacker to e…7.2
• CVE-2025-26201Credential disclosure vulnerability via the /staff route in …9.1
• CVE-2025-26202Cross-Site Scripting (XSS) vulnerability exists in the WPA/W…4.3
• CVE-2025-26204Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-26205Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…