Vulnerability · Published Sep 29, 2026 · Assigned by VulDB

CVE-2026-102290CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in Rocket LMS from CodeCanyon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
CodeCanyon	Rocket LMS	2.02.12.2

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-411167 | CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting vdb-entry
VDB-411167 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
CVE-2026-102290 | CVE Analysis and Report third-party-advisory
Submit #939876 | CodeCanyon Rocket LMS - Learning Management System 2.2 Stored XSS via Unrestricted File Upload third-party-advisory
https://gist.github.com/MuhammadAmmar-Hacker/05f13a39b35ae3dc31d86a5b919b5e2a related
https://drive.google.com/file/d/1kICrUOCzmXgf2iW1qEX8q9jW_R3twEBb/view?usp=sharing exploit