Lms
Monthly
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link. Reported by Patchstack, the flaw carries CVSS 7.1 with a scope change, reflecting cross-context impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to execute arbitrary operating system commands by supplying a malicious IP address parameter that is passed unsanitized to exec(). The flaw was reported by CERT-PL and an upstream fix is available; no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.6 reflects high impact on the vulnerable system with limited subsequent-system effect.
Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract sensitive database contents via the tarifflist.php module. The flaw stems from unsanitized concatenation of the POST tg[] array into a SQL query through implode(), and a CERT-PL-coordinated fix is upstream. No public exploit identified at time of analysis.
Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with course-editing privileges to write arbitrary files outside the intended upload directory by uploading a maliciously crafted SCORM ZIP package. The CVSS 4.0 base score of 9.4 reflects high impact across confidentiality, integrity, and availability with scope change to subsequent systems, though exploitation requires low-privileged authentication. No public exploit identified at time of analysis.
Frappe Learning Management System (LMS) prior to 2.54.2 lets authenticated low-privileged users retrieve and view certificate records that were never published, exposing certificate details belonging to other users instead of restricting them to the certificate owner and authorized staff. The flaw is a missing-authorization problem (CWE-862) in the LMS Certificate permission handling, scored 5.3 with a confidentiality-only impact - no data modification or privilege gain is possible, and lookups of published certificates (the mechanism third parties use for verification) continue to work as intended. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, which carries a this_month priority label.
Missing server-side authorization on quiz submission records in Frappe Learning Management System (LMS) lets an authenticated student write quiz results directly through the Frappe REST API, recording a passing or perfect score without their answers being verified and thereby unlocking course completion and certificates. The same gap allows a student to create a submission attributed to another user, consuming that user's allowed attempts and blocking their legitimate submissions. The vendor fixed the issue in version 2.54.0 and states there are no workarounds; no public exploit code has been identified at time of analysis, and the impact is confined to quiz-result integrity and availability - no other users' data is exposed and no elevated roles are granted.
Authenticated users of Frappe LMS can complete a paid course or certificate purchase for an arbitrary amount in versions prior to 2.52.1, because the checkout flow accepts client-supplied pricing instead of recomputing the price on the server. The impact is confined to business-logic and financial integrity - no other users' data is exposed and no elevated privileges are granted - and it only matters on sites that actually sell paid courses or certificates through the payment flow. Version 2.52.1 fixes the issue by deriving all pricing server-side via get_order_summary; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Frappe LMS versions up to and including 2.51.0 lets an authenticated user who holds a course-editing role plant malicious JavaScript in the Course Management meta tag fields, which is then stored and rendered unescaped into the course page (including the meta name/property tags for title, image, description and keywords, the og:/twitter: equivalents, the course title and description headings, and the 'Know More' link). The script executes in the browser of any second user who opens the affected course page, which is why victim interaction is required. Severity is rated Medium - CVSS 4.0 base 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N), with the independent assessment scoring CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; exploitation needs an authenticated editor account plus a victim visiting the page, no public exploit code was identified at time of analysis, and the issue is fixed in 2.52.0.
Stored cross-site scripting in Chamilo LMS's Ticket Module lets authenticated users who can create or edit ticket projects inject a script payload through the project Name field, which executes when another user views the affected page. The flaw affects Chamilo LMS up to 1.11.40, 2.0.3, and 3.0.1 and requires victim interaction; publicly available exploit code has been disclosed, though no CISA KEV active-exploitation confirmation is present. The vendor fix is visible in PR #9228 and commit cb6fe2127e587603451c609b4ed78c0293fcc3fa, and builds applying that output-encoding patch are not exploitable.
Cross-site scripting (XSS) in Enocta Platform allows authenticated users to inject script into HTML attribute contexts, potentially modifying the appearance or behavior of pages viewed by other users. The flaw affects all versions through 2026-09-28 according to TR-CERT, and exploitation requires an authenticated account (PR:L) plus a victim who views the crafted content (UI:R), yielding only limited integrity impact (CVSS 4.1). No public exploit identified at time of analysis.
SQL injection in Forma LMS up to and including version 4.1.43 allows an attacker with an authenticated session on the administrative back end to manipulate the 'Name' argument handled by UserselectorAdmController::getData in /appCore/ajax.adm_server.php?r=adm/userselector/getData, injecting arbitrary SQL against the underlying database. Exploitation is remote and requires no user interaction, but the vulnerable endpoint is admin-scoped (CVSS vector PR:L), so valid low-privileged/admin-panel credentials are a prerequisite; publicly available exploit code exists and the vendor was contacted without responding. This is a moderate, not top-tier, priority issue: the primary limiting factors are the authentication requirement and Forma LMS's comparatively limited deployment base, which constrain real-world exposure.
Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitrary JavaScript into the browsers of authenticated LMS users by crafting malicious links targeting the `dbrecover.php` and `netremap.php` modules. The `db`, `id`, and `mapto` GET parameters were directly concatenated into HTML anchor elements without sanitization, as confirmed by the upstream commit diff. No public exploit has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects genuinely constrained impact due to the required victim interaction and specific attack preconditions.
Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-editable fields that, when reflected in page metadata, silently redirects visiting users' browsers to an attacker-controlled URL. Exploitation requires a low-privilege account (PR:L) and passive victim interaction (UI:P) - a target must visit a page containing the poisoned content. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; its CVSS 4.0 score of 2.1 reflects genuinely low severity, though the redirect capability carries downstream phishing and credential-harvesting risk.
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthenticated remote attackers to inject and persist malicious scripts that execute in the browsers of other users. The vulnerability affects content structure functionality and has been patched in version 2.48.0. No public exploit code or active exploitation has been confirmed at time of analysis.
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files on the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link. Reported by Patchstack, the flaw carries CVSS 7.1 with a scope change, reflecting cross-context impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to execute arbitrary operating system commands by supplying a malicious IP address parameter that is passed unsanitized to exec(). The flaw was reported by CERT-PL and an upstream fix is available; no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.6 reflects high impact on the vulnerable system with limited subsequent-system effect.
Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract sensitive database contents via the tarifflist.php module. The flaw stems from unsanitized concatenation of the POST tg[] array into a SQL query through implode(), and a CERT-PL-coordinated fix is upstream. No public exploit identified at time of analysis.
Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with course-editing privileges to write arbitrary files outside the intended upload directory by uploading a maliciously crafted SCORM ZIP package. The CVSS 4.0 base score of 9.4 reflects high impact across confidentiality, integrity, and availability with scope change to subsequent systems, though exploitation requires low-privileged authentication. No public exploit identified at time of analysis.
Frappe Learning Management System (LMS) prior to 2.54.2 lets authenticated low-privileged users retrieve and view certificate records that were never published, exposing certificate details belonging to other users instead of restricting them to the certificate owner and authorized staff. The flaw is a missing-authorization problem (CWE-862) in the LMS Certificate permission handling, scored 5.3 with a confidentiality-only impact - no data modification or privilege gain is possible, and lookups of published certificates (the mechanism third parties use for verification) continue to work as intended. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, which carries a this_month priority label.
Missing server-side authorization on quiz submission records in Frappe Learning Management System (LMS) lets an authenticated student write quiz results directly through the Frappe REST API, recording a passing or perfect score without their answers being verified and thereby unlocking course completion and certificates. The same gap allows a student to create a submission attributed to another user, consuming that user's allowed attempts and blocking their legitimate submissions. The vendor fixed the issue in version 2.54.0 and states there are no workarounds; no public exploit code has been identified at time of analysis, and the impact is confined to quiz-result integrity and availability - no other users' data is exposed and no elevated roles are granted.
Authenticated users of Frappe LMS can complete a paid course or certificate purchase for an arbitrary amount in versions prior to 2.52.1, because the checkout flow accepts client-supplied pricing instead of recomputing the price on the server. The impact is confined to business-logic and financial integrity - no other users' data is exposed and no elevated privileges are granted - and it only matters on sites that actually sell paid courses or certificates through the payment flow. Version 2.52.1 fixes the issue by deriving all pricing server-side via get_order_summary; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Frappe LMS versions up to and including 2.51.0 lets an authenticated user who holds a course-editing role plant malicious JavaScript in the Course Management meta tag fields, which is then stored and rendered unescaped into the course page (including the meta name/property tags for title, image, description and keywords, the og:/twitter: equivalents, the course title and description headings, and the 'Know More' link). The script executes in the browser of any second user who opens the affected course page, which is why victim interaction is required. Severity is rated Medium - CVSS 4.0 base 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N), with the independent assessment scoring CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; exploitation needs an authenticated editor account plus a victim visiting the page, no public exploit code was identified at time of analysis, and the issue is fixed in 2.52.0.
Stored cross-site scripting in Chamilo LMS's Ticket Module lets authenticated users who can create or edit ticket projects inject a script payload through the project Name field, which executes when another user views the affected page. The flaw affects Chamilo LMS up to 1.11.40, 2.0.3, and 3.0.1 and requires victim interaction; publicly available exploit code has been disclosed, though no CISA KEV active-exploitation confirmation is present. The vendor fix is visible in PR #9228 and commit cb6fe2127e587603451c609b4ed78c0293fcc3fa, and builds applying that output-encoding patch are not exploitable.
Cross-site scripting (XSS) in Enocta Platform allows authenticated users to inject script into HTML attribute contexts, potentially modifying the appearance or behavior of pages viewed by other users. The flaw affects all versions through 2026-09-28 according to TR-CERT, and exploitation requires an authenticated account (PR:L) plus a victim who views the crafted content (UI:R), yielding only limited integrity impact (CVSS 4.1). No public exploit identified at time of analysis.
SQL injection in Forma LMS up to and including version 4.1.43 allows an attacker with an authenticated session on the administrative back end to manipulate the 'Name' argument handled by UserselectorAdmController::getData in /appCore/ajax.adm_server.php?r=adm/userselector/getData, injecting arbitrary SQL against the underlying database. Exploitation is remote and requires no user interaction, but the vulnerable endpoint is admin-scoped (CVSS vector PR:L), so valid low-privileged/admin-panel credentials are a prerequisite; publicly available exploit code exists and the vendor was contacted without responding. This is a moderate, not top-tier, priority issue: the primary limiting factors are the authentication requirement and Forma LMS's comparatively limited deployment base, which constrain real-world exposure.
Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitrary JavaScript into the browsers of authenticated LMS users by crafting malicious links targeting the `dbrecover.php` and `netremap.php` modules. The `db`, `id`, and `mapto` GET parameters were directly concatenated into HTML anchor elements without sanitization, as confirmed by the upstream commit diff. No public exploit has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects genuinely constrained impact due to the required victim interaction and specific attack preconditions.
Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-editable fields that, when reflected in page metadata, silently redirects visiting users' browsers to an attacker-controlled URL. Exploitation requires a low-privilege account (PR:L) and passive victim interaction (UI:P) - a target must visit a page containing the poisoned content. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; its CVSS 4.0 score of 2.1 reflects genuinely low severity, though the redirect capability carries downstream phishing and credential-harvesting risk.
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthenticated remote attackers to inject and persist malicious scripts that execute in the browsers of other users. The vulnerability affects content structure functionality and has been patched in version 2.48.0. No public exploit code or active exploitation has been confirmed at time of analysis.
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files on the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.