CVE-2023-53876

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - disclosure@vulncheck.com

Published

2025-12-15

Last modified

2026-04-07

Weaknesses

CWE-434

Affected products

• Academy Lms (Creativeitem)

References

• https://academylms.net/
• https://www.exploit-db.com/exploits/51702
• https://www.vulncheck.com/advisories/academy-lms-arbitrary-file-upload-vulnerability-via-profile-settings