PT-2026-25175 · Ays Pro · Fox Lms

W41Bu · Published 2026-03-13 · Updated 2026-03-15 · CVE-2026-31922

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Ays Pro Fox LMS versions through 1.0.6.3

Description The software contains a flaw related to improper neutralization of special elements used in an SQL command, leading to a Blind SQL Injection condition. This allows for potential unauthorized access or manipulation of data within the system. The issue affects the fox-lms component.

Recommendations Update Ays Pro Fox LMS to a version later than 1.0.6.3.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-31922

Affected Products

Fox Lms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31922 · Security Note
• https://twitter.com/CveFindCom/status/2032550802842112378 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032585004975534406 · Twitter Post
• https://twitter.com/CVEnew/status/2032998296105496852 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/fox-lms/vulnerability/wordpress-fox-lms-plugin-1-0-6-3-sql-injection-vulnerability?_s_id=cve · Note