PatchTheCVEcreativeitem vulnerabilities
Recent CVEs affecting creativeitem products. 6 tracked.
creativeitem has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-02-03. Highest priority: CVE-2025-56749 (score 53/100).
- CVE-2025-71179 MEDIUM 6.1 DOWNGRADE Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search para
- CVE-2025-56749 CRITICAL 9.4 UPGRADE Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing
- CVE-2025-56748 MEDIUM 6.4 UPGRADE Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encod
- CVE-2025-56747 MEDIUM 6.5 UPGRADE Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_ins
- CVE-2025-56746 LOW 2.2 UPGRADE Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authenticati
- CVE-2023-53876 MEDIUM 5.4 DOWNGRADE Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG f
FAQ
How do I fix creativeitem vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is creativeitem being exploited right now?
None of the tracked creativeitem CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which creativeitem CVE should I patch first?
CVE-2025-56749 currently ranks highest (53/100): Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.