CVE-2026-27404

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in LMS version 9.7 and earlier. It allows a remote attacker to inject malicious scripts without authentication.

An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the victim's browser context, leading to data confidentiality and integrity breaches.

Immediately upgrade LMS to a version later than 9.7 that includes the XSS fix. Additionally, implement input filtering and output encoding mechanisms.