Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-31281. PoCs published by saykino.
AI-analyzed exploit summary The repository describes an HTML injection vulnerability in Totara LMS's message box, allowing authenticated attackers to inject malicious code that executes in victims' browsers. The writeup includes technical details such as affected versions, attack type, and mitigation steps.
Description
Totara LMS v19.1.5 and before is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser.
Exploits (1)
The repository describes an HTML injection vulnerability in Totara LMS's message box, allowing authenticated attackers to inject malicious code that executes in victims' browsers. The writeup includes technical details such as affected versions, attack type, and mitigation steps.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H