Academy Lms vulnerabilities

2 known vulnerabilities in Academy Lms from Creativeitem. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Academy Lms: Use of Hard-coded Credentials

  CVE-2025-56749Oct 15, 2025Creativeitem

  Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

• 9.8 Critical severity

  LMS: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-4974Sep 15, 2023AcademyEPSS 5.26%

  A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max lea