Vulnerability details

CVE-2025-32808

W. W. Norton InQuizitive

CVSS 3.1

7.7High

Official description

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.

CVSS scores

Score	Version	Source	Vector
7.7High	3.1	CVEProject cvelistV5 (CNA) (mitre)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
W. W. Norton	InQuizitive	v ≤ 2025-04-08	CVEProject cvelistV5 (CNA)

References and advisories

https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-04-11
Last updated: 2025-04-11
State: Published
Assigner (CNA): mitre

Exploit prediction (EPSS)

0.41%

Probability of exploitation in 30 days

35.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-602
Client-Side Enforcement of Server-Side Security