CVE-2026-31281

HIGH

8.0

Descripcion

Totara LMS v19.1.5 and before is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser.

Detalles CVE

Puntuacion CVSS v3.18.0

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado4/13/2026

Ultima modificacion4/14/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-79

Referencias

https://github.com/saykino/CVE-2026-31281(cve@mitre.org)

https://www.totara.com/(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.