CVE-2025-56746

2.2 lowEPSS 0.2%

Low (2.2) in creativeitem academy lms. EPSS 0.2% chance of exploitation in the next 30 days.

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.

Severity

CVSS 3.1

2.2 low

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2025-10-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

creativeitem:academy_lms

References

https://suryadina.com/academy-lms-session-fixation-1t8v5n3q6h/

Check your stack JSON