Lenxel AI LMS – Course Lesson Generator Security & Risk Analysis

The "lenxel-core" v1.3.9 plugin exhibits a mixed security posture. While it demonstrates strengths in areas like using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns remain. The presence of unprotected AJAX handlers presents a direct pathway for unauthenticated malicious actions. Furthermore, the history of past vulnerabilities, particularly "PHP Remote File Inclusion" and "Cross-site Scripting," coupled with currently unpatched CVEs, indicates recurring weaknesses that attackers could exploit. The taint analysis, while not revealing critical or high-severity unsanitized paths, shows a concerning number of flows with unsanitized paths, suggesting potential for vulnerabilities if not carefully managed.

The "lenxel-core" plugin has a history of security issues, with a notable prevalence of Remote File Inclusion and Cross-site Scripting vulnerabilities. The fact that two CVEs remain unpatched in this version is a serious concern, demanding immediate attention from users. While the plugin employs good practices like prepared statements and extensive output escaping, the unprotected AJAX endpoints and the detected unsanitized paths in taint analysis highlight areas where attackers could gain a foothold. The plugin's attack surface is moderately large, and the unprotected entry points are a significant risk. Users should exercise extreme caution and prioritize updating to a version where these vulnerabilities are addressed.