PT-2025-42362 · Creativeitem · Creativeitem Academy Lms

Publicado 2025-10-15 · Atualizado 2025-10-15 · CVE-2025-56749

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Creativeitem Academy LMS versions up to and including 6.14

Description The software uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

Recommendations Update to a version beyond 6.14.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-56749

Produtos afetados

Creativeitem Academy Lms

Referências · 7

• 🔥 https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q · Exploit
• https://t.me/cveNotify/138784 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-56749 · Nota de Segurança
• https://t.me/CVEtracker/35007 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1978543008912957476 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1978562118677835816 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-56749 · Aviso do Fabricante