Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2025-32809: W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
CVE-2025-32809 · published 1 year ago
Summary
W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wwnorton | inquizitive |
<= 2025-04-08 cpe:2.3:a:wwnorton:inquizitive:*:*:*:*:*:*:*:* |
Original advisory text
W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
References
- https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-by... Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Apr 2025
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2025-32809 · NVD
Track software like this
Free during beta