CVE-2025-56746

CVE-2025-56746CVE-2025-56746

creativeitem / academy_lms

Description

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.

Scoring

CVSS 2.2 ()
VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Last modified2026-11-05
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.