RocketSoft Rocket LMS vulnerabilities

Latest RocketSoft Rocket LMS CVEs

Newest publication first

1. CVE-2021-47907 Rocket LMS 1.1 Persistent Cross-Site Scripting via Support Tickets

   Published 2026-05-10

   Medium·CVSS 5.1 EPSS 0.24%

   Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execu...

2. CVE-2024-34241 A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course not...

   Published 2024-05-17

   Medium·CVSS 4.8 EPSS 0.76%

   A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.

3. CVE-2023-3477 RocketSoft Rocket LMS Contact Form store cross site scripting

   Published 2023-06-30

   Medium·CVSS 6.1 EPSS 0.39%

   A vulnerability was found in RocketSoft Rocket LMS 1.7. It has been declared as problematic. This vulnerability affects unknown code of the file /contact/store of the component Contact Form. The manipulation of the argument name/subject/message leads to cross site scripting. The...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.