TI-2025-40417 CVE-2025-65669 · GHSA-43w2-q5cj-hwmq
An issue was discovered in classroomio 0.1.13.
Priority HIGH 78
An issue was discovered in classroomio 0.1.13.
classroomio
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
classroomio records in CISA KEVNo classroomio vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Classroomio · all components
TI-2025-40419 CVE-2025-65672 · GHSA-px6j-wc84-gwhf
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share…
Priority HIGH 72
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
TI-2025-40421 CVE-2025-65676 · GHSA-rxc6-c5mm-j9vx
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…
Priority MEDIUM 58
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
TI-2025-40420 CVE-2025-65675 · GHSA-gfvq-wmqw-q9j2
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…
Priority MEDIUM 58
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
TI-2025-40418 CVE-2025-65670 · GHSA-mh75-3225-9wcj
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to…
Priority MEDIUM 53
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, a…
TI-2025-41187 CVE-2025-67298 · GHSA-j8cg-23h3-5p99
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via…
Priority LOW 37
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile