PatchTheCVEacademy lms vulnerabilities and fixes
Recent CVEs affecting academy lms, with upgrade or downgrade steps. 8 tracked.
Also searched as: academylms.
academy lms has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-02-03. Highest priority: CVE-2025-56749 (score 53/100).
- CVE-2025-71179 MEDIUM 6.1 DOWNGRADE Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search para
- CVE-2025-56749 CRITICAL 9.4 UPGRADE Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing
- CVE-2025-56748 MEDIUM 6.4 UPGRADE Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encod
- CVE-2025-56747 MEDIUM 6.5 UPGRADE Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_ins
- CVE-2025-56746 LOW 2.2 UPGRADE Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authenticati
- CVE-2024-38959 MEDIUM 6.1 DOWNGRADE Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a rem
- CVE-2024-38701 MEDIUM 4.3 UPGRADE Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS:
- CVE-2023-53876 MEDIUM 5.4 DOWNGRADE Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG f
FAQ
How do I fix academy lms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is academy lms being exploited right now?
None of the tracked academy lms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which academy lms CVE should I patch first?
CVE-2025-56749 currently ranks highest (53/100): Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.