CVE-2023-53876 | THREATINT

Description

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

PUBLISHED Reserved 2025-12-13 | Published 2025-12-15 | Updated 2025-12-15 | Assigner VulnCheck

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

Unrestricted Upload of File with Dangerous Type

Product status

6.1

affected

Credits

CraCkEr finder

References

www.exploit-db.com/exploits/51702 exploit

www.exploit-db.com/exploits/51702 (ExploitDB-51702) exploit

academylms.net/ (Academy LMS Product Webpage) technical-description

www.vulncheck.com/...load-vulnerability-via-profile-settings (VulnCheck Advisory: Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings) third-party-advisory

cve.org (CVE-2023-53876)

nvd.nist.gov (CVE-2023-53876)

Download JSON