Lectora Desktop and Online XSS Vulnerability Enables JavaScript Injection

On September 23, 2025, a critical cross-site scripting (XSS) vulnerability was disclosed affecting Lectora Desktop and Lectora Online, allowing attackers to inject JavaScript via crafted URL parameters. Discovered by researcher Mohammad Jassim and documented by CERT, the vulnerability (CVE-2025-9125) affects Lectora Desktop versions 21.0 to 21.3 and Lectora Online up to version 7.1.6. Exploitation could lead to session hijacking and user redirection.

Users are advised to update to Lectora Desktop version 21.4 or later and republish existing courses to mitigate risks. The flaw poses significant risks for organizations relying on Lectora for training and compliance.