CVE-2026-2058 is a high severity SQL injection flaw (CVSS 7.3) in the CloudClassroom-PHP-Project by mathurvishal. The gnamex argument in /postquerypublic.php reaches a query unsafely and a public exploit exists. The vendor did not respond, so fix the query or retire the app.
What's affected
CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be is affected, in /postquerypublic.php through the gnamex argument. The project uses rolling releases, so the record says affected and updated versions cannot be specified. The record also says the vendor was contacted early and did not respond.
How to check if you're exposed
Check whether the affected file exists in your deployment:
find . -name postquerypublic.php
If it does, review how the ID or user value reaches the SQL query in that file, and check your web server logs for unusual values in that parameter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. It will not find flaws in code you wrote, so pair it with a review of the query in the affected file.
What to do now
- Find out whether the application is deployed anywhere you manage.
- Take it off the public internet, or put it behind a login or VPN, if it is a demo or training system.
- Change the query to use prepared statements with bound parameters, and validate the value type.
- Run the database user with the least rights the application needs, and check logs for earlier abuse.
Why it matters
SQL injection, CWE-89, happens when a request value is placed into a database query as text instead of being passed as a parameter. The database cannot tell data from instructions, so crafted input can change what the query does. CWE-74 is the parent class, improper neutralization of special elements.
The fix pattern is the same everywhere: parameterized queries, input validation and a database account with the minimum rights. The CVE is not in CISA's KEV list.
Quick check
Is a vendor patch available?
The record lists none. Fix the code yourself or retire the software.
Is exploitation confirmed in the wild?
The record says an exploit is public. It does not report attacks, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
