MantraBrain vulnerabilities and threats

CVE-2026-48836 is a critical vulnerability in MantraBrain Easy Invoice versions up to and including 2.1.19 that allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This vulnerability enables an attacker to execute arbitrary code remotely without any authentication. The vulnerability has a CVSS score of 10.0, indicating maximum severity with high impact on confidentiality, integrity, and availability.

Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.

The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.