CVE-2025-11304: CodeCanyon/ui-lib Mentor LMS API cross-domain policy
A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11304?
CVE-2025-11304 is classified as a high severity vulnerability due to its potential for cross-domain policy manipulation.
How do I fix CVE-2025-11304?
To fix CVE-2025-11304, upgrade to a version of Mentor LMS that is higher than 1.1.1.
What types of attacks can exploit CVE-2025-11304?
CVE-2025-11304 can be exploited through remote attacks that manipulate cross-domain policies.
Which version of Mentor LMS is affected by CVE-2025-11304?
Mentor LMS versions up to and including 1.1.1 are affected by CVE-2025-11304.
Is CVE-2025-11304 a remote or local vulnerability?
CVE-2025-11304 is a remote vulnerability, allowing exploitation from untrusted domains.