Vulnerabilities

TI-2025-41187 CVE-2025-67298 · GHSA-j8cg-23h3-5p99

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via…

LOW 37

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00253 Published 2026-03-11 No fix listed CWE-290

TI-2025-40421 CVE-2025-65676 · GHSA-rxc6-c5mm-j9vx

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…

MEDIUM 58

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00253 Published 2025-11-26 No fix listed CWE-79

TI-2025-40420 CVE-2025-65675 · GHSA-gfvq-wmqw-q9j2

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…

MEDIUM 58

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00253 Published 2025-11-26 No fix listed CWE-79

TI-2025-40419 CVE-2025-65672 · GHSA-px6j-wc84-gwhf

Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share…

HIGH 72

Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2025-11-26 No fix listed CWE-639

TI-2025-40418 CVE-2025-65670 · GHSA-mh75-3225-9wcj

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to…

MEDIUM 53

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00262 Published 2025-11-26 No fix listed CWE-639

TI-2025-40417 CVE-2025-65669 · GHSA-43w2-q5cj-hwmq

An issue was discovered in classroomio 0.1.13.

HIGH 78

An issue was discovered in classroomio 0.1.13.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00502 Published 2025-11-26 No fix listed CWE-862

Vulnerabilities

Filters

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via…

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows…

Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share…

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to…

An issue was discovered in classroomio 0.1.13.