CVE-2025-26199 Information disclosure in n/a
Attackers can intercept login credentials via Man-in-the-Middle attacks due to unencrypted HTTP transmission, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26199?
CVE-2025-26199 is a critical vulnerability in n/a, published on 18 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.
Weakness: CWE-319
Which versions are affected by CVE-2025-26199?
It affects 1 product.
Products include Vishalmathur Cloudclassroom-Php Project.
How do I fix CVE-2025-26199?
No fix has been published for CVE-2025-26199 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-26199 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26199 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6j6h-gw62-v4w9.