InQuizitive
by W. W. Norton
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-32808 | Hig | 0.50 | 7.7 | 0.00 | Apr 11, 2025 | W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists. | ||
| CVE-2025-32809 | Med | 0.42 | 6.4 | 0.00 | Apr 11, 2025 | W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id. |
- risk 0.50cvss 7.7epss 0.00
W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.
- risk 0.42cvss 6.4epss 0.00
W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.