Stored Cross Site Scripting Vulnerability in Classroomio LMS by Classroomio
CVE-2025-65675
Currently unrated
Key Information:
- Vendor
Classroomio
- Status
- Vendor
- CVE Published:
- 26 November 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-65675?
A stored Cross Site Scripting (XSS) vulnerability exists in Classroomio LMS version 0.1.13, which allows authenticated attackers to inject and execute arbitrary code through specially crafted SVG profile pictures. This can potentially compromise user accounts and sensitive data, posing significant risks to the security and integrity of the e-learning platform.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.