CVEvulnerability

CVE-2025-56746

2.2 LOW Published 2025-10-15 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-10-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
2.2 LOW — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-384

Description

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.

Affected configurations

• creativeitem academy lms (<= 5.13)

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References