PT-2025-37398

CVE-2025-10388

Published

2025-09-14

Updated

2025-09-14

Description by

CVSS 2.0

4.0

Medium

MetricsAV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Selleo Mentingo version 2025.08.27

Description A cross-site scripting issue exists due to manipulation of the Description argument in the processing of the /api/course/enroll-course endpoint within the Create New Course Basic Settings component. The attack can be launched remotely.

Recommendations As a temporary workaround, consider restricting access to the /api/course/enroll-course endpoint until a fix is available. Sanitize the Description argument to prevent the injection of malicious scripts.

Exploitability

Exploit

Fix

Impacts

Researchers

Khanmarshal

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers