CVE-2024-34241

A persistent cross-site scripting (XSS) vulnerability exists in Rocketsoft Rocket LMS version 1.9 . The flaw allows an administrator to store a JavaScript payload via the admin web interface when creating new courses or new course notifications . Attackers can target areas utilizing a WYSIWIG edi...

CVE-2023-3477

The CVE-2023-3477 issue affects RocketSoft Rocket LMS 1.7, specifically the Contact Form component at /contact/store. The root cause described across connected docs is that the name/subject/message parameters can be manipulated to trigger cross-site scripting, with remote initiation. Several sour...