Threat Entry Updated 2026-02-27

CVE-2026-1106 - LMS Plugin

A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/SocialController.php of the component Legal Consent Handler. Performing a manipulation of the argument userId results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

PLUGIN LMS

CVE-2026-1106

MEDIUM CVSS 5.3 2026-01-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-23497 - Lms Plugin

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.

PLUGIN Lms

CVE-2026-23497

LOW CVSS 1.3 2026-01-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-12

CVE-2024-9270 - Lms Plugin

The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

PLUGIN Lms

CVE-2024-9270

MEDIUM CVSS 6.4 2024-11-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-4602 - Lms Plugin

The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Lms

CVE-2023-4602

MEDIUM CVSS 6.1 2023-11-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-27

CVE-2023-0844 - Lms Plugin

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Lms

CVE-2023-0844

MEDIUM CVSS 4.8 2023-03-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-10

CVE-2023-0548 - Lms Plugin

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Lms

CVE-2023-0548

MEDIUM CVSS 4.8 2023-02-27

Risk Score

Open Full Technical Breakdown