CVE-2025-13784

MediumCVSS 4.8/10Last modified Oct 18, 2026

Description

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
yungifez	Skuul School Management System	2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5

References

https://gist.github.com/thezeekhan/7fc54fd44bc5f318be0350b367b2d8ffExploit, Third Party Advisory
https://vuldb.com/?ctiid.333788Permissions Required, VDB Entry
https://vuldb.com/?id.333788Third Party Advisory, VDB Entry
https://vuldb.com/?submit.689012Third Party Advisory, VDB Entry
https://gist.github.com/thezeekhan/7fc54fd44bc5f318be0350b367b2d8ffExploit, Third Party Advisory
https://vuldb.com/?submit.689012Third Party Advisory, VDB Entry

Timeline

Published: Nov 30, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-137856.5A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processin CVE-2025-137869.8A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /ind CVE-2025-137879.1A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of CVE-2025-137889.8A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribut CVE-2025-137895.3A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulati CVE-2025-13799.8A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vuln CVE-2025-137908.8A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request for CVE-2025-137916.5A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter CVE-2025-137927.3A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /htm CVE-2025-137934.3A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is CVE-2025-137944.3The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab CVE-2025-137952.4A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an un