CVE-2022-38553

Academy Learning Management System before version 5.9.1 was found to have a reflected cross-site scripting (XSS) vulnerability via the Search parameter. An attacker can inject a malicious script that executes in the victim's browser.

The risk includes potential session hijacking, redirection to malicious sites, or other actions within the victim's session context, which could lead to data confidentiality breaches.

Immediately update Academy LMS to version 5.9.1 or later, which includes a fix for the XSS vulnerability. Additionally, implement input filtering and output encoding for the Search parameter.