CVE-2025-32808

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-602

Affected software

Vendor	Product	Versions
W. W. Norton	InQuizitive	<= 2025-04-08

References

https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22faExploit, Third Party Advisory
https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22faExploit, Third Party Advisory

Timeline

Published: Apr 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-328095.4W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedbac CVE-2025-32815.3The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D CVE-2025-328137.2An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.CVE-2025-328149.8An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.CVE-2025-328156.5An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.CVE-2025-328163.1CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.CVE-2025-328176.1A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthoriz CVE-2025-328187.5A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash t CVE-2025-328198.8A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete CVE-2025-32825.3The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D CVE-2025-328208.8A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make an CVE-2025-328217.2A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell com