Vulnerabilidades do Classroomio Classroomio
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Classroomio Classroomio: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:classroomio:classroomio
CVE-2025-67298
Alta · 8.1
CWE-290 11/03/2026
Authentication Bypass by Spoofing em Classroomio
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
CVE-2025-65670
Média · 4.3
CWE-639 26/11/2025
Authorization Bypass Through User-Controlled Key (IDOR) em Classroomio
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.
CVE-2025-65676
Média · 5.4
CWE-79 26/11/2025
Cross-site Scripting (XSS) em Classroomio
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
CVE-2025-65675
Média · 5.4
CWE-79 26/11/2025
Cross-site Scripting (XSS) em Classroomio
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
CVE-2025-65672
Alta · 7.5
CWE-639 26/11/2025
Authorization Bypass Through User-Controlled Key (IDOR) em Classroomio
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
CVE-2025-65669
Crítica · 9.1
CWE-862 26/11/2025
Missing Authorization em Classroomio
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.