CVE-2026-102290

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79
• CWE-94

• https://drive.google.com/file/d/1kICrUOCzmXgf2iW1qEX8q9jW_R3twEBb/view?usp=sharing
• https://gist.github.com/MuhammadAmmar-Hacker/05f13a39b35ae3dc31d86a5b919b5e2a
• https://vuldb.com/cve/CVE-2026-102290
• https://vuldb.com/submit/939876
• https://vuldb.com/vuln/411167
• https://vuldb.com/vuln/411167/cti

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102277The brace-expansion library generates arbitrary strings cont…5.3
• CVE-2026-102278The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-102279Laravel is a web application framework. Prior to 12.69.0 and…3.1
• CVE-2026-10228A vulnerability was found in raisulislamg4 student_managemen…3.5
• CVE-2026-102281Nest is a framework for building scalable Node.js server-sid…7.5
• CVE-2026-10229A vulnerability was determined in Assimp up to 6.0.4. This a…5.3
• CVE-2026-102292A flaw has been found in coolbeans1212 MateisHomePage-Websit…4.3
• CVE-2026-102293A vulnerability was identified in realjerrytang tacomall 1.0…7.3
• CVE-2026-102296ZoneMinder before 1.38.4 contains static buffer overflow vul…6.5
• CVE-2026-102297ZoneMinder before 1.38.4 fails to apply per-monitor access r…4.3
• CVE-2026-1023Statistics Database System developed by Gotac has a Missing …8.7
• CVE-2026-10230A vulnerability was identified in Assimp up to 6.0.4. This i…5.3