CVE-2023-53876 — Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings
Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can injec…
Published: 2025-12-15 · CVSS: 5.1 · CVSS 4.0
Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7