Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47907Rocket LMS 1.1 Persistent Cross-Site Scripting via Support Tickets

Medium 6.4

In plain English

A medium-severity cross-site scripting in Rocket LMS from Rocketsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browsers of other users viewing the message history, enabling session hijacking and phishing attacks.

Affected products (as reported)

Vendor	Product	Versions
Rocketsoft	Rocket LMS	1.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50677 exploit
Official Product Homepage product
VulnCheck Advisory: Rocket LMS 1.1 Persistent Cross-Site Scripting via Support Tickets third-party-advisory