Creativeitem
12 CVEs across 14 Creativeitem products. Browse Creativeitem vulnerabilities, severities, and proof-of-concept exploits.
Creativeitem products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66031 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-66030 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrar… |
CVE-2026-66029 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-66028 | Medium | 6.7 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create dupli… |
CVE-2025-71179 | Medium | 6.1 | 2026-02-03 | Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the str… |
CVE-2023-53876 | Medium | 5.4 | 2025-12-15 | Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. A… |
CVE-2025-56749 | Critical | 9.4 | 2025-10-15 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge vali… |
CVE-2025-56748 | Medium | 6.4 | 2025-10-15 | Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brut… |
CVE-2025-56746 | Low | 2.2 | 2025-10-15 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attac… |
CVE-2025-56747 | Medium | 6.5 | 2025-10-14 | Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated us… |
CVE-2025-40992 | | 2025-10-02 | Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affectin… | |
CVE-2025-40991 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40990 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40989 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-27264 | High | 7.5 | 2025-03-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Bookin… |
CVE-2025-27263 | High | 8.5 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointmen… |
CVE-2024-38959 | Medium | 6.1 | 2024-07-09 | Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain… |
CVE-2023-4974 | Medium | 6.3 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/fi… |
CVE-2023-4973 | Low | 3.5 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2023-38964 | Medium | 6.1 | 2023-08-04 | Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2023-4119 | Medium | 4.3 | 2023-08-03 | A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The… |
CVE-2023-3756 | Low | 3.5 | 2023-07-19 | A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is some unknown functiona… |
CVE-2023-3755 | Low | 3.5 | 2023-07-19 | A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulnerability is an unknow… |
CVE-2023-3754 | Low | 3.5 | 2023-07-19 | A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /i… |
CVE-2023-3753 | Low | 3.5 | 2023-07-19 | A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of… |
CVE-2023-3752 | Low | 3.5 | 2023-07-19 | A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2022-47132 | High | 8.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users. |
CVE-2022-47131 | Medium | 4.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page. |
CVE-2022-47130 | Medium | 4.3 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privilege… |
CVE-2022-38553 | Medium | 6.1 | 2022-09-26 | Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. |
CVE-2022-29380 | Medium | 4.8 | 2022-05-25 | Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. |
CVE-2020-22273 | Medium | 6.5 | 2020-11-04 | Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings) |
CVE-2018-18417 | Medium | 5.4 | 2018-10-19 | In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to th… |