CVE-2025-55200

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.13

Description BigBlueButton, an open-source virtual classroom, has a Stored Cross-Site Scripting (XSS) issue in the "Shared Notes" feature. The input location for this issue is the Username field, and the output is displayed on the "Shared Notes" page when a user with a malicious username edits content. This allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users, such as Admins, who open the "Shared Notes" page.

Recommendations Update to BigBlueButton version 3.0.13 or later.