Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

LMS by Masteriyo < 1.6.8 - Information Exposure

The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. id: CVE-2023-3345 info: name: LMS by Masteriyo 1.6.8 - Information Exposure author: DhiyaneshDK...

CVE-2026-119478

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56...

EUVD-2026-119092

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56...

CVE-2026-45140

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-45140 Write-up: https://abraxaslabs.tech/research/CVE-2026-45140 CVE-2026-45140 Chamilo LMS 2.0.0 - chamilo I am @abraxasnull. Loopback lab. The client is CVE-2026-45140-Abraxas-Labs.py. The advisory did not...

CVE-2021-43129

CVE-2021-43129 Vulnerability in D2L Brightspace’s Learning Management SystemLMS Vulnerability Type: CWE-668: Exposure of Resource to Wrong Sphere Vendor of Product: Desire2Learn/D2L Affected Product Code Base: D2L Brightspace’s Learning Management SystemLMS Tested version: 20.21.7 D2L announced...

CVE-2026-61806

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff...

CVE-2026-61805

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without...

CVE-2026-61803

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-39375

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

EUVD-2026-114253

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff...

EUVD-2026-114252

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without...

CVE-2026-61803 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-61803

Frappe Learning Management System (LMS) versions prior to 2.52.1 are vulnerable to a business-logic integrity issue within the course/certificate checkout flow. The system improperly accepts client-controlled pricing , which allows an authenticated user to complete a purchase for a paid course or...

CVE-2026-61803 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-61803 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

EUVD-2026-114197

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

EUVD-2026-114195

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375 Frappe LMS has Stored XSS in Course Meta

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...