CVE-2023-53876 - CVE House
Back to Database
Status published Medium CVE-2023-53876

Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings

Vulnerability Description

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-53876

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • CraCkEr

References

More from Creativeitem

View All →
CVE-2025-40992
Stored XSS in Creativeitem Sociopro
Medium 5.1
CVE-2025-40991
Stored XSS in Creativeitem Ekushey CRM
Medium 5.1
CVE-2025-40990
Stored XSS in Creativeitem Ekushey CRM
Medium 5.1
CVE-2025-40989
Stored XSS in Creativeitem Ekushey CRM
Medium 5.1
CVE-2025-27264
WordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerability
High 7.5

Affected Vendor

Creativeitem

View all reports →

Affected Software

Academy LMS
Vulnerable Versions:
6.1

Timeline

Official Publish: December 15th, 2025
Last Modified: April 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact