Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
Priority LOW 34CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schoolbox Pty Ltd | Schoolbox | 21.0.2 | — | No fix listed | CNA |
- Schoolbox VendorSchoolbox Pty Ltd Affected 21.0.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schoolbox:schoolbox:21.0.2:*:*:*:*:*:*:* | 21.0.2 | Vulnerable | Schoolbox Pty Ltd |
- cpe:2.3:a:schoolbox:schoolbox:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Schoolbox Pty Ltd
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39020
- 2026-10-03 Alias added: GHSA-297g-9xq6-v8vj
References
More Schoolbox Pty Ltd Schoolbox vulnerabilities
- TI-2022-02822 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd CVSS 3.1HIGH 8.6
- TI-2024-18675 Blind SQL Injection in Chat functionality in Schoolbox CVSS 3.1HIGH 8.8
- TI-2024-18678 Stored Cross-site Scripting in Calendar functionality in Schoolbox CVSS 3.1HIGH 7.3
- TI-2024-18677 Stored Cross-site Scripting in Class functionality in Schoolbox CVSS 3.1HIGH 7.3
- TI-2024-18676 Stored Cross-site Scripting in News functionality in Schoolbox CVSS 3.1HIGH 7.3
Sources
- CVE-2022-39020 · CVE Program
- CVE-2022-39020 · NVD
- FIRST EPSS
- GHSA-297g-9xq6-v8vj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences