AL
Product
Academy LMS
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 12Low 1
Watch
Add Academy LMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-4974 | 9.8 | Sep 15 | A vulnerability was found in Academy LMS 6.2 Affected: 6.2 |
| CVE-2025-56749 | 9.4 | Oct 15 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing Affected: through 6.14 |
| CVE-2022-47132 | 8.8 | Feb 3 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users Affected: before 5.10 |
| CVE-2025-56747 | 6.5 | Oct 14 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access… Affected: through 5.13 |
| CVE-2025-56748 | 6.4 | Oct 15 | Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to… Affected: through 5.13 |
| CVE-2025-71179 | 6.1 | Feb 3 | Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the… Affected: 7.0 |
| CVE-2024-38959 | 6.1 | Jul 9 | Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive… Affected: 6.8.1 |
| CVE-2023-4973 | 6.1 | Sep 15 | A vulnerability was found in Academy LMS 6.2 on Windows Affected: 6.2 |
| CVE-2023-38964 | 6.1 | Aug 4 | Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability Affected: 6.0 |
| CVE-2023-4119 | 6.1 | Aug 3 | A vulnerability has been found in Academy LMS 6.0 and classified as problematic Affected: 6.0 |
| CVE-2023-3752 | 6.1 | Jul 19 | A vulnerability was found in Creativeitem Academy LMS 5.15 Affected: 5.15 |
| CVE-2023-53876 | 5.4 | Dec 15 | Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings Affected: 6.1 |
| CVE-2022-47131 | 4.8 | Feb 3 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page Affected: before 5.10 |
| CVE-2022-29380 | 4.8 | May 25 | Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel Affected: 4.3 |
| CVE-2022-47130 | 4.3 | Feb 3 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the… Affected: before 5.10 |
| CVE-2025-56746 | 2.2 | Oct 15 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user… Affected: through 5.13 |
Showing 16