PT-2025-40820 · Codecanyon · Ui-Lib+1

Jaredloo · Published 2025-10-05 · Updated 2025-10-06 · CVE-2025-11304

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodeCanyon/ui-lib Mentor LMS versions up to 1.1.1

Description A flaw exists in the component API of CodeCanyon/ui-lib Mentor LMS. This issue can lead to a permissive cross-domain policy with untrusted domains, allowing for remote attacks. The exploit has been published. The vendor was contacted but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-942

Related Identifiers

CVE-2025-11304

Affected Products

Mentor Lms

Ui-Lib

References · 9

• 🔥 https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888 · Exploit
• 🔥 https://github.com/PlsRevert/CVEs/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11304 · Security Note
• https://twitter.com/CVEnew/status/1974949373370114262 · Twitter Post
• https://t.me/cveNotify/137429 · Telegram Post
• https://vuldb.com/?submit.661733 · Note
• https://vuldb.com/?id.327185 · Note
• https://vuldb.com/?ctiid.327185 · Note
• https://t.me/CVEtracker/34189 · Telegram Post