Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Academy LMS — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in Academy LMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates all known security vulnerabilities affecting the Academy LMS learning management system, categorized by specific weakness types and tagged for efficient filtering. The collection encompasses a comprehensive range of issues, including authentication flaws, privilege escalation vectors, and data exposure incidents, covering the entire documented history of the product from its initial release to the present day. Security professionals and administrators can utilize this resource to track the vendor's official security advisories, analyze the prevalence and impact of specific weakness classes within educational software, or review the complete vulnerability history of the Academy LMS platform to inform risk assessments. By centralizing disparate reports and technical details, this aggregation facilitates a clearer understanding of the product's evolving security posture without requiring users to search multiple external databases. The data presented here is strictly factual, derived from public disclosures and vendor announcements, ensuring that readers receive accurate information regarding past and current threats. This centralized view supports proactive defense strategies by highlighting recurring patterns in the product's security landscape. Users can quickly identify which components are most frequently targeted and evaluate the effectiveness of historical patches. The aggregation serves as a critical reference point for maintaining the integrity of learning environments that rely on this specific software solution.

Vendor: Creativeitem

CVE ID Title CVSS Severity Published
CVE-2026-104050 Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers - - 2026-10-07
CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint - - 2026-10-07
CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint - - 2026-08-03
CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint - - 2026-07-31
CVE-2026-14184 Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR - - 2026-07-21
CVE-2026-9341 Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter CWE-639 4.3 Medium 2026-07-14
CVE-2026-25372 WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability CWE-862 6.5 Medium 2026-02-19
CVE-2025-68527 WordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2025-12-24
CVE-2023-53876 Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings CWE-434 5.4AI Medium AI 2025-12-15
CVE-2025-59562 WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability CWE-639 5.5 Medium 2025-09-22
CVE-2024-38701 WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability CWE-639 4.3 Medium 2024-07-22
CVE-2024-37234 WordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability CWE-601 3.5 Low 2024-07-06
CVE-2024-32714 WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability CWE-862 4.3 Medium 2024-06-09
CVE-2024-35171 WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability CWE-200 5.3 Medium 2024-05-13
CVE-2024-33912 WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability CWE-862 7.1 High 2024-05-06
CVE-2023-3752 Creativeitem Academy LMS courses cross site scripting CWE-79 3.5 Low 2023-07-19

All 16 known CVE vulnerabilities affecting Academy LMS with full Chinese analysis, references, and POCs where available.