EUVD-2026-21928CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Totara LMS v19.1.5 and before is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser.
AnalysisAI
HTML Injection in Totara LMS through version 19.1.5 allows authenticated users with low privileges to inject malicious HTML/JavaScript into messages sent to all application users, enabling session hijacking and arbitrary command execution in victims' browsers. A publicly available exploit exists (GitHub POC referenced), though no confirmed active exploitation (not in CISA KEV). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit current Totara LMS deployment version and identify all instances running version 19.1.5 or earlier; disable or restrict messaging functionality for low-privilege users if operationally feasible. Within 7 days: Implement input validation and output encoding controls on all user-generated message content; review access logs for suspicious messaging activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today