The vulnerability CVE-2024-11321 in Hi e-learning LMS is a reflected Cross-site Scripting (CWE-79) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted input, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects LMS versions prior to 06.12.2024. The CVSS 3.1 base score is 5.4, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity. No patch or official remediation level has been published yet.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser session, potentially leading to limited disclosure or modification of information accessible to the user. The impact is rated as medium severity with low confidentiality and integrity impact and no impact on availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links that may exploit this vulnerability.