CPE Details
CREATIVEITEM Academy LMS 5.15
5.15
2023-07-24
11h41 +00:00
11h41 +00:00
2023-08-07
12h12 +00:00
12h12 +00:00
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
CPE Name: cpe:2.3:a:creativeitem:academy_lms:5.15:*:*:*:*:*:*:*
Informations
Vendor
creativeitemProduct
academy_lmsVersion
5.15Related CVE
| CVE ID | Publié | Description | Score | Gravité |
|---|---|---|---|---|
| Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account. | 9.4 |
Critique |
||
| A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home/courses. The manipulation of the argument sort_by leads to cross site scripting. The attack may be launched remotely. VDB-234422 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 6.1 |
Moyen |
