CVE-2023-53876CWE-434

Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings

Medium · published December 15, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00246 · 14.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-12-15T20:28Z
EPSS history
Timeline
  • 15 DEC 20:28Z
    Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings
    cvelistv5