Rocket LMS EUVD-2026-88641

Requires the attacker to hold an authenticated low-privilege account (PR:L - e.g. a self-registered student) on a Rocket LMS instance version <=2.2, and to reach the Student Profile Image Upload feature. Exploitation is NOT self-contained: it depends on victim interaction (UI:P) - a second user such as an admin, instructor, or another student must subsequently view the attacker's profile for the stored payload to fire. There is no fixed version available (vendor non-responsive), so all affected deployments remain exposed. Limiting factors: account registration must be possible, the profile must be viewable by a target, and the payload only yields client-side script execution in the viewer's session - not server-side access.

This is a genuinely low-to-moderate priority issue despite the CROSS-SITE-SCRIPTING classification. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores 5.1 (medium) and the signals are internally consistent: network vector, low complexity, but requiring low-privilege authentication (PR:L - an attacker must hold a Rocket LMS student account) AND victim interaction (UI:P - a second user must view the profile). Impact is integrity-only and limited (VI:L, with VC:N and VA:N), reflecting a stored XSS that runs script in a viewer's session rather than granting server compromise. Exploitation signals: publicly available exploit code exists (VulDB E:P, a gist plus a Google Drive PoC), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or automated exploitation - PoC availability is a distinct and lower signal than in-the-wild use. The E:P (Proof-of-Concept) exploit maturity aligns with the PoC being published but unweaponized. Net: a real, publicly-documented flaw that is meaningfully gated by the dual requirement of an authenticated account plus victim interaction, in a niche commercial product. It should be patched but does not warrant emergency response.

An attacker registers a low-privilege student account on a Rocket LMS site and uploads a manipulated profile image whose handling injects a stored XSS payload. When an instructor, admin, or another student views the attacker's profile, the script executes in their browser session, enabling session/cookie theft or actions in their context. A public proof-of-concept (gist and Google Drive file) exists, lowering the skill needed to reproduce it.