PT-2026-25175 · Ays Pro · Fox Lms

W41Bu · Publicado 2026-03-13 · Atualizado 2026-03-15 · CVE-2026-31922

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Ays Pro Fox LMS versions through 1.0.6.3

Description The software contains a flaw related to improper neutralization of special elements used in an SQL command, leading to a Blind SQL Injection condition. This allows for potential unauthorized access or manipulation of data within the system. The issue affects the fox-lms component.

Recommendations Update Ays Pro Fox LMS to a version later than 1.0.6.3.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-31922

Produtos afetados

Fox Lms

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31922 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2032550802842112378 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2032585004975534406 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032998296105496852 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/fox-lms/vulnerability/wordpress-fox-lms-plugin-1-0-6-3-sql-injection-vulnerability?_s_id=cve · Nota