Skip to content
OpenAdvisories

Vendor

HeliumEdu

2 known vulnerabilities.

Products

platform 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.5
    CVE-2026-55876

    Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

    Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BL…

    HeliumEdu platform