CVE-2025-0581

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
CampCodes	School Management Software	1.0

References

https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20Stored%20Cross%20Site%20Scripting-%20Account%20Takeover%20Possibility.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.292599Permissions Required, VDB Entry
https://vuldb.com/?id.292599Third Party Advisory, VDB Entry
https://vuldb.com/?submit.484895Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Jan 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-05827.2A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code o CVE-2025-05836.1The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute a CVE-2025-05845.3The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability CVE-2025-05859.8The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comma CVE-2025-05867.2The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privil CVE-2025-05877.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Thi CVE-2025-05884.9In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By s CVE-2025-05895.3In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated CVE-2025-05907.5Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-05917.8Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an appli CVE-2025-05928.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploadin CVE-2025-05938.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact wit