Log in Start free

Vulnerability · Published Oct 5, 2025 · Assigned by VulDB

CVE-2025-11304CodeCanyon/ui-lib Mentor LMS API cross-domain policy

Medium 6.3

In plain English

A medium-severity security flaw in Mentor LMS from CodeCanyon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
CodeCanyon Mentor LMS 1.1.01.1.1
ui-lib Mentor LMS 1.1.01.1.1

Weakness: CWE-942, CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References