CVE-2026-102290

LOW 3.5

CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-79 CWE-94
Vendor	codecanyon
Product	rocket lms
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for codecanyon rocket lms

Be the first to know when new low vulnerabilities affecting codecanyon rocket lms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

CodeCanyon / Rocket LMS

2.0 2.1 2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/411167 vuldb.com: https://vuldb.com/vuln/411167/cti vuldb.com: https://vuldb.com/cve/CVE-2026-102290 vuldb.com: https://vuldb.com/submit/939876 gist.github.com: https://gist.github.com/MuhammadAmmar-Hacker/05f13a39b35ae3dc31d86a5b919b5e2a drive.google.com: https://drive.google.com/file/d/1kICrUOCzmXgf2iW1qEX8q9jW_R3twEBb/view?usp=sharing

Credits

🔍 Muhammad_Ammar (VulDB User) VulDB CNA Team