TI-2025-40417 CVE-2025-65669 · GHSA-43w2-q5cj-hwmq
An issue was discovered in classroomio 0.1.13.
Priority HIGH 78
An issue was discovered in classroomio 0.1.13.
classroomio
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
classroomio records in CISA KEVNo classroomio vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2025-40419 CVE-2025-65672 · GHSA-px6j-wc84-gwhf
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share…
Priority HIGH 72
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
Priority MEDIUM 60
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses.
TI-2025-40421 CVE-2025-65676 · GHSA-rxc6-c5mm-j9vx
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…
Priority MEDIUM 58
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
TI-2025-40420 CVE-2025-65675 · GHSA-gfvq-wmqw-q9j2
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…
Priority MEDIUM 58
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
TI-2025-40418 CVE-2025-65670 · GHSA-mh75-3225-9wcj
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to…
Priority MEDIUM 53
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, a…
TI-2025-41187 CVE-2025-67298 · GHSA-j8cg-23h3-5p99
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via…
Priority LOW 37
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
TI-2026-75099 CVE-2026-111369
ClassroomIO Incorrect Authorization via Lesson Update and Delete Routes
Priority LOW 31
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons.