CVE-2026-31281

Totara LMS (versions v19.1.5 and before ) is vulnerable to HTML Injection within the in-app messaging client . An authenticated attacker can inject malicious HTML code into a message and distribute it to all application users. This could result in the execution of malicious code on the victim's b...