Is CVE-2025-13784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13784 being exploited in the wild.

How severe is CVE-2025-13784?

Low severity, with a CVSS score of 3.1, published 30 November 2025.

Which products and versions are affected?

yungifez/skuul (Packagist) ECOSYSTEM:introduced=0,last_affected=2.6.5; Yungifez Skuul School Management System up to 2.6.5.

Is there a fix for CVE-2025-13784?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13784 attacked?

It is attacked over the network.

Am I affected by CVE-2025-13784?

Check whether you run yungifez/skuul (Packagist), Yungifez Skuul or Yungifez Skuul School Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13784: yungifez Skuul School Management System stored XSS in SVG handler

CVE-2025-13784 · Severity: low · CVSS 3.1 · Published 2025-11-30

Skuul is a school management platform used to administer student records and communications. An administrator can upload malicious SVG image files that execute JavaScript code when viewed by any user, potentially stealing credentials, redirecting to phishing sites, or compromising the entire system if an admin account is affected.

Technologies: yungifez/skuul (Packagist), Yungifez Skuul. Vendors: Packagist, Yungifez.

Quick answers

Is CVE-2025-13784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13784 being exploited in the wild.
How severe is CVE-2025-13784?: Low severity, with a CVSS score of 3.1, published 30 November 2025.
Which products and versions are affected?: yungifez/skuul (Packagist) ECOSYSTEM:introduced=0,last_affected=2.6.5; Yungifez Skuul School Management System up to 2.6.5.
Is there a fix for CVE-2025-13784?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13784 attacked?: It is attacked over the network.
Am I affected by CVE-2025-13784?: Check whether you run yungifez/skuul (Packagist), Yungifez Skuul or Yungifez Skuul School Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is stored cross-site scripting (XSS) combined with open redirect, arising from insufficient validation of SVG file uploads in the school editor component (/dashboard/schools/1/edit). SVG files are processed without sanitization and served with default content-type headers, allowing embedded JavaScript event handlers (e.g., onload attributes) and redirection payloads to execute in the victim's browser. An authenticated attacker can upload a crafted SVG; when any user opens the image directly in a new tab, the malicious script executes with the user's session privileges. The exploit is publicly available. No patch is currently known; the vendor was contacted but did not respond.

Affected products

yungifez Skuul School Management System up to 2.6.5

Identifiers

CVE-2025-13784
GHSA-92x3-mfjp-j3h3

Timeline

2025-11-04: disclosed: Vulnerability reported on GitHub Gist
2025-11-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.