#LMS
All CosmicBytez Labs articles tagged #LMS, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-45140: Chamilo LMS Unauthenticated Remote Code Execution
A CVSS 9.8 flaw in Chamilo LMS's CStudio plugin import flow lets unauthenticated attackers execute arbitrary code on the server.
- Security
CVE-2026-45143: Chamilo LMS Stored XSS Enables Student-to-Admin Takeover
Unsanitized private messages in Chamilo LMS let a low-privilege student fire stored XSS at an admin's inbox, no link click required.
- Security
CVE-2026-63227: Koollab LMS SCORM File Upload Allows Webshell Deployment and RCE
A CVSS 9.9 critical vulnerability in Koollab LMS allows authenticated module designers to upload a SCORM package containing a PHP webshell to a publicly...
- Security
CVE-2026-63232: Koollab LMS SQL Injection and RCE via Unsafe Deserialisation
A critical CVSS 9.9 vulnerability in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe PHP deserialisation in the assessment...
- Security
CVE-2026-13332: Masteriyo LMS Allows Unauthenticated Force-Logout of Any User
A critical unauthenticated AJAX vulnerability in the Masteriyo LMS WordPress plugin allows attackers to terminate any user's session — including...
- Security
Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
- News
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell
A hardcoded machineKey value in KnowledgeDeliver's configuration enabled ViewState deserialization attacks leading to remote code execution and web shell.
- News
KnowledgeDeliver Flaw Exploited as Zero-Day to Install Web
Attackers exploited a critical zero-day vulnerability in KnowledgeDeliver LMS servers to deploy the Godzilla web shell, giving persistent backdoor access to.
- News
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A now-patched high-severity zero-day vulnerability in Digital Knowledge's KnowledgeDeliver LMS, a popular learning management system in Japan, was actively.
- News
Edu-Tech Firm Instructure Discloses Cyber Incident, Probes
Instructure, the company behind the widely used Canvas learning management system, has disclosed a cybersecurity incident and is investigating its scope....
- Security
CVE-2026-30884: Critical Authorization Bypass in Moodle
A critical (CVSS 9.6) authorization bypass vulnerability in the moodle-mod_customcert plugin allows any teacher with manage capability in a single course...