CVE-2026-16765 is a SQL injection vulnerability affecting CodeAstro Online Classroom 1.0. The flaw exists in the loginlinkadmin.php script where the 'aid' argument is not properly sanitized, enabling remote attackers to inject malicious SQL commands. The vulnerability can be exploited without authentication or user interaction. Although publicly disclosed, there is no vendor-provided fix or mitigation at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, no known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks in the affected parameter.