Academy LMS version 6.1 suffers from an upload vulnerability that could lead to persistent cross site scripting attacks.