A JavaScript snippet that exploits a design vulnerability in SCORM-based e-learning platforms to mark any online course as completed instantly — without watching a single slide.
This works because SCORM 1.2 and SCORM 2004 expose a JavaScript API (
window.API/window.API_1484_11) directly in the browser, with no server-side validation on whether the learner actually consumed the content. Any value you set via the API is trusted and persisted by the LMS.
LMS platforms (Moodle, Cornerstone, SAP SuccessFactors, TalentLMS, Docebo, etc.) rely on the course itself to report progress back to the platform. The browser is the middleman — and the middleman can be intercepted.
By calling LMSSetValue (SCORM 1.2) or SetValue (SCORM 2004) directly from the browser console, you can send arbitrary completion data — status, score, time spent — without any interaction with the course content.
Launch the course from your LMS so it loads in the browser.
Press F12 or Ctrl + Shift + I, then click the Console tab.
Chrome blocks pasting in the console by default. Type this manually and press Enter:
allow pasting
Copy the content of scorm-complete.js from the releases or directly from this repo, paste it into the console and press Enter.
The script will:
- Auto-detect whether the course uses SCORM 1.2 or SCORM 2004
- Search for the API across the window and all nested iframes automatically
- Set status, score, progress and session time
- Commit and close the session
The LMS will show the course as Completed — 100%.
| Standard | API Object | Status Field | Tested |
|---|---|---|---|
| SCORM 1.2 | window.API |
cmi.core.lesson_status |
Yes |
| SCORM 2004 (Ed. 2/3/4) | window.API_1484_11 |
cmi.completion_status |
Yes |
Works on any LMS that implements SCORM without server-side content validation — which is the vast majority of them.
No API found in console — The course is inside an iframe that the script cannot reach due to cross-origin restrictions. In the console dropdown (top-left, usually showing top), manually select the course frame and run the script again from there.
Platform does not update — Save is sometimes asynchronous. Wait a few seconds and reload.
Already initialized error — The course called LMSInitialize on its own before you ran the script. This is handled automatically by the IIFE wrapper; if you still get errors, remove the Initialize line and run from SetValue onwards.
This tool is provided for educational and research purposes. Using it to fraudulently complete mandatory compliance training, certifications, or any course with legal or professional implications is your own responsibility.