CVE-2025-12269

LOW

LearnHouse < 2025-09-21 - Cross-Site Scripting in Account Setting Page

Title source: llm
STIX 2.1

Description

A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/settings/previews of the component Account Setting Page. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
https://vuldb.com/?id.329941
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.329941
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.674146

Scores

CVSS v3 3.5
EPSS 0.0023
EPSS Percentile 13.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
learnhouse/learnhouse < 2025-09-21
Published Oct 27, 2025
Tracked Since Feb 18, 2026