{“lastseen”:”2025-11-25T19:06:53″,”description”:”Classroomio LMS version 0.1.13 suffers from multiple persistent cross site scripting vulnerabilities via uploaded SVG files…”,”published”:”2025-11-25T00:00:00″,”modified”:”2025-11-25T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Classroomio LMS 0.1.13 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212009″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65675″,”CVE-2025-65676″],”sourceData”:”# CVE-2025-65676\\n Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. Discovered by – Rivek Raj Tamang (RivuDon), Sikkim, India.\\n \\n **Affected Product: ClassroomIO**\\n * Affected Version: 0.1.13\\n * **Discovered by: Rivek Raj Tamang (RivuDon), Sikkim, India**\\n \\n ## Vulnerability Details\\n Stored Cross Site Scripting\\n \\n # Summary\\n A Stored Cross-Site Scripting (XSS) vulnerability exists in Classroomio LMS version 0.1.13, where the application fails to sanitize course cover image uploads. An authenticated attacker can upload a malicious SVG file containing embedded JavaScript, which is then stored and executed whenever the course cover image is viewed. Because the payload is executed from a trusted domain, this flaw can lead to session hijacking, account takeover, redirection attacks, or further exploitation within the platform.\\n \\n ## Steps to Reproduce\\n \\n 1. Log in and go to created course or create one\\n \\n 2. Click on landing page\\n \\n 3. Click on Header \\u003e replace image cover\\n \\n 3. Select the xss svg file and click on upload\\n \\n 4. Wait for it to save, refresh the page\\n \\n \\u003cimg width=\\”1919\\” height=\\”858\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/40c1eaee-439c-4cd8-9b7c-d2ea1b9d4ba9\\” \/\\u003e\\n \\n 6. Right click on the course cover image and open on a new tab\\n \\n 7. Note the stored xss being popped.\\n \\n \\u003cimg width=\\”701\\” height=\\”361\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/ef9b4d7d-627e-403b-9e45-6ae7417f7c11\\” \/\\u003e\\n \\n \\n # Acknowledgement \\n \\n This vulnerability was discovered and responsibly reported by:\\n \\n **Rivek Raj Tamang (RivuDon) from Sikkim, India** \\n \\n https:\/\/www.linkedin.com\/in\/rivektamang\/\\n \\n https:\/\/rivudon.medium.com\/\\n \\n \\n ————————\\n \\n \\n # CVE-2025-65675\\n Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures. Discovered by – Rivek Raj Tamang (RivuDon), Sikkim, India.\\n \\n **Affected Product: ClassroomIO**\\n * Affected Version: 0.1.13\\n * **Discovered by: Rivek Raj Tamang (RivuDon), Sikkim, India**\\n \\n ## Vulnerability Details\\n Stored Cross Site Scripting\\n \\n # Summary\\n A Stored Cross-Site Scripting (XSS) vulnerability exists in Classroomio LMS version 0.1.13, where the application fails to sanitize SVG profile image uploads. An authenticated attacker can upload a malicious SVG file containing embedded JavaScript, which is then stored and executed whenever the profile image is viewed. Because the payload is executed from a trusted domain, this flaw can lead to session hijacking, account takeover, redirection attacks, or further exploitation within the platform.\\n \\n ## Steps to Reproduce\\n \\n 1. Log in and go to profile settings\\n \\n 2. Click on upload image\\n \\n 3. Select the xss svg file and click on upload\\n \\n 4. Wait for it to save\\n \\n \\u003cimg width=\\”1564\\” height=\\”700\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/46dffab6-bc8c-45c4-ac4e-945f1aef01c4\\” \/\\u003e\\n \\n \\n 6. Right click on the profile picture and open on a new tab\\n \\n 7. Note the stored xss being popped.\\n \\n \\u003cimg width=\\”576\\” height=\\”298\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/4dbcfecd-a565-4e9b-aba3-304f09246b17\\” \/\\u003e\\n \\n \\n # Acknowledgement \\n \\n This vulnerability was discovered and responsibly reported by:\\n \\n **Rivek Raj Tamang (RivuDon) from Sikkim, India** \\n \\n https:\/\/www.linkedin.com\/in\/rivektamang\/\\n \\n https:\/\/rivudon.medium.com\/”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212009″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212009\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-25T19:06:53″,”description”:”Classroomio LMS version 0.1.13 suffers from multiple persistent cross site scripting vulnerabilities via uploaded SVG files…”,”published”:”2025-11-25T00:00:00″,”modified”:”2025-11-25T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Classroomio LMS 0.1.13 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212009″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65675″,”CVE-2025-65676″],”sourceData”:”# CVE-2025-65676\\n Stored Cross…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-27586","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n