Is CVE-2025-63892 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-63892 being exploited in the wild.

How severe is CVE-2025-63892?

Medium severity, with a CVSS score of 6.8, published 18 November 2025.

Is there a fix for CVE-2025-63892?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-63892 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-63892?

Check whether you run SourceCodester Student Grades Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-63892: SourceCodester Student Grades Management System stored XSS in classroom.php

CVE-2025-63892 · Severity: medium · CVSS 6.8 · Published 2025-11-18

A vulnerability exists in the Student Grades Management System, a web application used for managing academic records. An attacker with teacher-level access can inject malicious scripts into classroom descriptions. When an administrator or another user views the affected classroom page, the script executes automatically, potentially leading to account takeover, theft of sensitive session information, or unauthorized actions within the system.

Technologies: SourceCodester Student Grades Management System. Vendors: SourceCodester.

Quick answers

Is CVE-2025-63892 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-63892 being exploited in the wild.
How severe is CVE-2025-63892?: Medium severity, with a CVSS score of 6.8, published 18 November 2025.
Which products and versions are affected?: SourceCodester Student Grades Management System 1.0.
Is there a fix for CVE-2025-63892?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-63892 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-63892?: Check whether you run SourceCodester Student Grades Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Student Grades Management System 1.0 within the 'create_classroom' function of /classroom.php. The application fails to sanitize user-supplied input in the 'name' and 'description' arguments before storing them in the database and rendering them on the My Classrooms Management Page. An attacker with high privileges (e.g., a teacher account) can inject arbitrary JavaScript, such as '<img src=1 onerror=alert(1)>'. The payload executes in the context of any user, including administrators, who navigates to the affected page. This can lead to session hijacking via cookie theft or unauthorized administrative actions. No patch is currently documented in the advisory.

Affected products

SourceCodester Student Grades Management System 1.0

Timeline

2025-11-18: advisory: Initial disclosure and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.