Loading story…
Rhino Security Labs disclosed multiple vulnerabilities in Frappe LMS that can be chained to give a student-level attacker remote code execution on the LMS server after an administrator views the attacker’s profile. The chain combines stored cross-site scripting in profile bio previews, tracked as CVE-2026-34606, with a SCORM-upload path traversal flaw, CVE-2026-39405, allowing a privileged course creator to write extracted archive content outside the intended assets directory and overwrite application files.
The stored XSS stems from BeautifulSoup get_text() concatenating otherwise benign text fragments into executable HTML without re-sanitizing the output. Researchers also reported CVE-2026-46546, a meta-tag injection flaw that enables open redirects. Frappe LMS v2.44.0 was confirmed vulnerable; the issues are fixed in v2.50.1, and organizations should upgrade promptly and review LMS servers for unauthorized file changes or suspicious profile content.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Frappe LMS Project posted CVE-2026-39405 for SCORM-upload path traversal, CVE-2026-34606 for stored XSS, and CVE-2026-46546 for meta-tag injection leading to open redirect.
Frappe stated that all reported vulnerabilities had been fixed. Frappe LMS version 2.50.1 is identified as the fixed version, while version 2.44.0 was confirmed vulnerable.
Frappe acknowledged the researchers' disclosure of the reported Frappe LMS vulnerabilities.
Researchers initially disclosed multiple Frappe LMS vulnerabilities to Frappe, including flaws that could be chained from student-level access to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcerhinosecuritylabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Three Learning's **Koollab LMS 5.3.2** was disclosed with multiple high-severity vulnerabilities that can expose databases, enable account takeover, and lead to remote code execution. The most critical issues include **pre-authentication SQL injection** in the SSO OAuth endpoint (`CVE-2026-63229`) and SCORM report endpoint (`CVE-2026-63230`), which allow unauthenticated attackers to read sensitive database contents such as personally identifiable information, credentials, and valid JWT tokens. A **post-authentication SQL injection** in the face-to-face runs update endpoint (`CVE-2026-63231`) can also expose the full application database and help attackers obtain JWTs for takeover of user accounts. The advisory also details several paths to **server-side code execution**. An unrestricted SCORM upload flaw (`CVE-2026-63227`) lets an authenticated module designer place a PHP webshell in a publicly accessible directory, while two SQL injection and unsafe deserialization chains in the assessment reinforcement and manual mark assessment endpoints (`CVE-2026-63232`, `CVE-2026-63234`) allow authenticated attackers to influence data passed to `unserialize()`, write webshells, and execute arbitrary code on the server. Singapore's Cyber Security Agency said the broader disclosure covers **16 vulnerabilities** across remote code execution, authentication bypass, access control, information disclosure, and business logic weaknesses, and that fixes were rolled out to all cloud-hosted SaaS instances by Three Learning.
Jul 29, 2026
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to **1.11.38**, including **CVE-2026-33698**, an unauthenticated remote code execution issue tied to the `main/install/` directory, and **CVE-2026-31939**, a path traversal flaw in `main/exercise/savescores.php` that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if `main/install/` remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server. The second flaw allows user-controlled input from `$_REQUEST['test']` to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under **CWE-552**, **CWE-22**, and **CWE-73**, and both were addressed in **Chamilo LMS 1.11.38** through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Jun 29, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026