CVE-2025-57205: iNiLabs School Express · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 22 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediate mitigation should include restricting administrative access to trusted personnel only and enforcing strong authentication mechanisms such as multi-factor authentication (MFA) to reduce the risk of credential compromise.
- Implement strict input validation and output encoding on all content-management inputs, especially the POSTed editor parameters, to sanitize HTML and JavaScript content before storage and rendering.
- Deploy a robust Content Security Policy (CSP) that restricts the execution of inline scripts and only allows trusted sources for scripts and other active content.
- Monitor logs and user activity for unusual behavior indicative of exploitation attempts, such as unexpected content changes or script injections.
- Until an official patch is available, consider disabling or limiting the use of the vulnerable content-management features or endpoints if feasible.
- Educate administrative users about the risks of XSS and safe content management practices.
- Regularly update and patch the SMS Express software once vendor fixes are released.
- Conduct security assessments and penetration testing focused on web application vulnerabilities to identify and remediate similar issues proactively.
Description
iNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/{id} endpoint (and similarly in Notice and Pages editors). Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is saved and later rendered unsanitized, resulting in JavaScript execution in other users' browsers when they access the affected content. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially leading to session hijacking, privilege escalation, data exfiltration, or administrative account takeover. The application does not enforce a restrictive Content Security Policy (CSP) or adequate filtering to prevent such attacks.