Khan Academy: XSS on using the legacy "Graphie To Png" API

The legacy "Graphie To Png" API was vulnerable to exploitation. An attacker could upload malicious graphies that included harmful SVG and JSON data. The SVG contained an onload attribute that executed arbitrary JavaScript. The JSON data modified the content of labels, causing the graphie renderer...

Exploit for Cross-Site Request Forgery (CSRF) in Creativeitem Academy_Lms

CVE-2022-47130 Academy LMS = 5.10 CSRF Description Acad...

Exploit for Cross-Site Request Forgery (CSRF) in Creativeitem Academy_Lms

CVE-2022-47132 Academy LMS = 5.10 CSRF Description Acad...

PT-2024-38989 · Unknown · Alwindoss Akademy

Name of the Vulnerable Software and Affected Versions: alwindoss akademy up to 35caccea888ed63d5489e211c99edff1f62efdba Description: A problem has been found in an unknown functionality of the file cmd/akademy/handler/handlers.go. The manipulation of the emailAddress argument leads to cross-site...

brightonacademy.org Cross Site Scripting vulnerability OBB-3953838

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-38701

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4...

CVE-2024-38701

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4...

canadianacademyofdentalhygiene.ca Cross Site Scripting vulnerability OBB-3948431

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-38701 WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4...

CVE-2024-38701

CVE-2024-38701 (Academy LMS – WordPress Plugin) : The vulnerability is an Authorization Bypass Through User-Controlled Key in the Academy LMS WordPress plugin, affecting versions from n/a up to 2.0.4. Public sources identify it as a broken access control issue; CVSS data from NVD shows high impac...

CVE-2024-38701 WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4...

PT-2024-28145 · Unknown · Academy Lms

Name of the Vulnerable Software and Affected Versions: Academy LMS versions n/a through 2.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS. Recommendations: For versions n/a through 2.0.4, at the moment, there is no...

digitallibrary.academyofathens.gr Cross Site Scripting vulnerability OBB-3945715

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by filime Patchstack Alliance in WordPress Plugin Academy LMS versions = 2.0.4...

WordPress Academy LMS Plugin <= 2.0.4 is vulnerable to Broken Access Control

Software Academy LMS Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38701 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1381c0d8b2d7 Credits filime Required privilege Academy...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

Creativeitem Academy-LMS Security Vulnerability

Creativeitem Academy-LMS is an online learning platform from Creativeitem, Inc. A security vulnerability exists in Creativeitem Academy-LMS version v.6.8.1, which stems from a cross-site scripting vulnerability that allows remote attackers to execute arbitrary code and obtain sensitive informatio...