This vulnerability in Classroomio LMS 0.1.13 involves stored cross-site scripting (CWE-79) where authenticated attackers can inject malicious scripts via specially crafted SVG files used as profile pictures. When these SVG images are rendered, the embedded script executes, potentially allowing code execution within the context of the affected application session. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity without availability impact.

Successful exploitation allows an authenticated attacker to execute arbitrary code in the context of the vulnerable application, potentially leading to partial disclosure or modification of data. There is no indication of availability impact. This could compromise user sessions or data confidentiality within the LMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, consider restricting SVG uploads or sanitizing SVG content to mitigate risk.