Creativeitem
Creativeitem Academy LMS: vulnerabilidades y CVE
Creativeitem Academy LMS tiene 16 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE16
Últimos 12 meses6
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-71179 | Media (6.1) | 0.25% | — | 3 feb 2026 | Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query… |
| CVE-2023-53876 | Media (5.1) | 0.25% | — | 15 dic 2025 | Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile… |
| CVE-2025-56749 | Crítica (9.4) | 0.47% | — | 15 oct 2025 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and… |
| CVE-2025-56748 | Media (6.4) | 0.22% | — | 15 oct 2025 | Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise… |
| CVE-2025-56746 | Baja (2.2) | 0.16% | — | 15 oct 2025 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session… |
| CVE-2025-56747 | Media (6.5) | 0.29% | — | 14 oct 2025 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role… |
| CVE-2024-38959 | Media (6.1) | 0.67% | — | 9 jul 2024 | Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter. |
| CVE-2023-4974 | Crítica (9.8) | 5.3% | — | 15 sept 2023 | A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The… |
| CVE-2023-4973 | Media (6.1) | 1.9% | — | 15 sept 2023 | A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter… |
| CVE-2023-38964 | Media (6.1) | 1.1% | — | 4 ago 2023 | Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
| CVE-2023-4119 | Media (6.1) | 3.8% | — | 3 ago 2023 | A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross… |
| CVE-2023-3752 | Media (6.1) | 0.36% | — | 19 jul 2023 | A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home/courses. The manipulation of the argument sort_by… |
| CVE-2022-47132 | Alta (8.8) | 0.86% | — | 3 feb 2023 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users. |
| CVE-2022-47131 | Media (4.8) | 0.41% | — | 3 feb 2023 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page. |
| CVE-2022-47130 | Media (4.3) | 0.62% | — | 3 feb 2023 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page. |
| CVE-2022-29380 | Media (4.8) | 0.62% | — | 25 may 2022 | Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.