Skip to content
Noroxi

Creativeitem records

26 published records for vendor creativeitem.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2023-4974
    41Plan

    Academy LMS GET Parameter filter sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    creativeitem · academy lmsSep 14, 2023

  • CVE-2025-56749
    37Monitor

    Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.

    CriticalCVSS 9.4No exploitEPSS 0%

    creativeitem · academy lmsOct 15, 2025

  • CVE-2022-47132
    35Monitor

    A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.

    HighCVSS 8.8Proof of conceptEPSS 1%

    creativeitem · academy lmsFeb 2, 2023

  • CVE-2020-22273
    26Monitor

    Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Setting

    MediumCVSS 6.5No exploitEPSS 0%

    creativeitem · neoflex video subscription systemNov 4, 2020

  • CVE-2025-56747
    26Monitor

    Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regul

    MediumCVSS 6.5No exploitEPSS 0%

    creativeitem · academy lmsOct 14, 2025

  • CVE-2023-4119
    25Monitor

    Academy LMS courses cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 4%

    creativeitem · academy lmsAug 3, 2023

  • CVE-2022-38553
    25Monitor

    Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Sear

    MediumCVSS 6.1Proof of conceptEPSS 3%

    creativeitem · academy learning management systemSep 26, 2022

  • CVE-2023-4973
    25Monitor

    Academy LMS GET Parameter filter cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 2%

    creativeitem · academy lmsSep 14, 2023

  • CVE-2025-56748
    25Monitor

    Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limi

    MediumCVSS 6.4No exploitEPSS 0%

    creativeitem · academy lmsOct 15, 2025

  • CVE-2023-38964
    24Monitor

    Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    creativeitem · academy lmsAug 4, 2023

  • CVE-2024-38959
    24Monitor

    Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitr

    MediumCVSS 6.1No exploitEPSS 1%

    creativeitem · academy lmsJul 9, 2024

  • CVE-2023-3754
    24Monitor

    Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · ekushey project managerJul 18, 2023

  • CVE-2023-3756
    24Monitor

    Creativeitem Atlas Business Directory Listing search cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · atlasJul 19, 2023

  • CVE-2023-3755
    24Monitor

    Creativeitem Atlas Business Directory Listing filter_listings cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · atlasJul 19, 2023

  • CVE-2023-3753
    24Monitor

    Creativeitem Mastery LMS browse cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · mastery lmsJul 18, 2023

  • CVE-2023-3752
    24Monitor

    Creativeitem Academy LMS courses cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · academy lmsJul 18, 2023

  • CVE-2025-71179
    24Monitor

    Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs en

    MediumCVSS 6.1No exploitEPSS 0%

    creativeitem · academy lmsFeb 3, 2026

  • CVE-2018-18417
    21Monitor

    In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the n

    MediumCVSS 5.4Proof of conceptEPSS 2%

    creativeitem · ekushey project managerOct 19, 2018

  • CVE-2023-53876
    20Monitor

    Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings

    MediumCVSS 5.1No exploitEPSS 0%

    creativeitem · academy lmsDec 15, 2025

  • CVE-2025-40991
    20Monitor

    Stored XSS in Creativeitem Ekushey CRM

    MediumCVSS 5.1No exploitEPSS 0%

    creativeitem · ekushey project manager crmOct 2, 2025

  • CVE-2025-40989
    20Monitor

    Stored XSS in Creativeitem Ekushey CRM

    MediumCVSS 5.1No exploitEPSS 0%

    creativeitem · ekushey project manager crmOct 2, 2025

  • CVE-2025-40990
    20Monitor

    Stored XSS in Creativeitem Ekushey CRM

    MediumCVSS 5.1No exploitEPSS 0%

    creativeitem · ekushey project manager crmOct 2, 2025

  • CVE-2022-29380
    19Monitor

    Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.

    MediumCVSS 4.8Proof of conceptEPSS 1%

    creativeitem · academy lmsMay 25, 2022

  • CVE-2022-47131
    19Monitor

    A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    creativeitem · academy lmsFeb 2, 2023

  • CVE-2022-47130
    17Monitor

    A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with admin

    MediumCVSS 4.3Proof of conceptEPSS 1%

    creativeitem · academy lmsFeb 2, 2023