Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

MasterStudy LMS allows hackers to access sensitive data

CVE-2025-64366 · published 1 year ago
Summary

A security flaw in MasterStudy LMS software makes it possible for hackers to access sensitive information without being detected. This affects versions 3.6.27 and earlier, and administrators should update to a fixed version to protect user data.

Original advisory text
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection....
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.6.27.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published31 Oct 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-64366 · NVD
Track software like this
Free during beta