| शीर्षक | CodeCanyon Rocket LMS - Learning Management System 2.2 Stored XSS via Unrestricted File Upload |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability exists in Rocket LMS v2.2 within the Student Profile Image upload functionality.
An authenticated student user can upload an SVG image containing malicious JavaScript while updating their profile picture in Settings. The application accepts the SVG file without properly validating or sanitizing its contents.
After the image is uploaded, the SVG can be accessed directly through its published link, causing the embedded JavaScript to execute within the application's origin.
Because the malicious SVG is stored on the server, the vulnerability is persistent. |
|---|
| स्रोत | ⚠️ https://gist.github.com/MuhammadAmmar-Hacker/05f13a39b35ae3dc31d86a5b919b5e2a |
|---|
| उपयोगकर्ता | Muhammad_Ammar (UID 99381) |
|---|
| सबमिशन | 19/08/2026 11:52 PM (1 महीना पहले) |
|---|
| संयम | 28/09/2026 10:13 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411167 [CodeCanyon Rocket LMS तक 2.2 Student Profile Image Upload क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|