CVE-2025-11304
CodeCanyon/ui-lib Mentor LMS API cross-domain policy
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 5, 2025
- Updated
- Oct 6, 2025
- Reserved
- Oct 4, 2025
Description
A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Mentor LMSCodeCanyon |
|
Mentor LMSui-lib |
|
References
- VDB-327185 | CodeCanyon/ui-lib Mentor LMS API cross-domain policyvdb-entry
- VDB-327185 | CTI Indicators (IOB, IOC)signaturepermissions-required
- Submit #661733 | ui-lib Mentor LMS 1.1.1 Origin Validation Errorthird-party-advisory
- https://github.com/PlsRevert/CVEs/issues/3issue-tracking
- https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.