CVE-2023-4119
MediumCVSS 4.3Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A vulnerability has been found in Academy LMS 6.0 that leads to cross site scripting attacks. The issue affects unknown code in the file /academy/home/courses, and manipulation of the argument query/sort_by allows for remote attacks.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code, potentially leading to user data theft or session hijacking. Organizations should be aware of the security risks associated with their applications.
Recommendation
It is recommended to update to the latest version of Academy LMS and to monitor and secure the application against XSS attacks. Additional protective measures, such as input data filtering, should also be considered.
Original NVD description (English source)
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.