Vulnerabilidades de Creativeitem
CVEs publicadas que afetam produtos de Creativeitem: 10 registro(s), com severidade, exploração e correções.
CVE-2025-71179
Média · 6.1
CWE-79 03/02/2026
Cross-site Scripting (XSS) em Creativeitem Academy Lms
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.
CVE-2023-53876
Média · 5.4
CWE-434 15/12/2025
Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings
Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.
CVE-2025-56749
Crítica · 9.4
CWE-798 15/10/2025
Use of Hard-coded Credentials em Creativeitem Academy Lms
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
CVE-2025-56748
Média · 6.4
CWE-640 15/10/2025
Weak Password Recovery Mechanism em Creativeitem Academy Lms
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
CVE-2025-56746
Baixa · 2.2
CWE-384 15/10/2025
Session Fixation em Creativeitem Academy Lms
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
CVE-2025-56747
Média · 6.5
CWE-269 14/10/2025
Improper Privilege Management em Creativeitem Academy Lms
Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
CVE-2025-40992
Média · 5.1
CWE-79 02/10/2025
Stored XSS in Creativeitem Sociopro
Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-40991
Média · 5.4
CWE-79 02/10/2025
Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-40990
Média · 5.4
CWE-79 02/10/2025
Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-40989
Média · 5.4
CWE-79 02/10/2025
Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.