Creativeitem vulnerabilities
We track 4 vulnerabilities in Creativeitem products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2025.
Latest Creativeitem vulnerabilities
- 9.4 Critical severity
Academy Lms: Use of Hard-coded Credentials
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
- 7.5 High severity
Doctor Appointment Booking: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows PHP Local File Inclusion.This issue affects Doctor Appointment Bo
- 8.5 High severity
Doctor Appointment Booking: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows SQL Injection.This issue affects Doctor Appointment Booking: from n/a through <= 1.0
- 9.8 Critical severity
LMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max lea