EUVD-2026-89723

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...

CVE-2026-102579

A flaw in Moodle involves an incorrect capability check within the grade web service . This vulnerability allows an authenticated student to access the profile information of other students enrolled in the same course without proper authorization. This flaw leads to unauthorized information discl...

CVE-2026-102579 Moodle: user profile information disclosure via grade web service

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

CVE-2026-102579 Moodle: user profile information disclosure via grade web service

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

CVE-2026-102588

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-103116: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...

CVE-2026-103115: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-103125

Name of the Vulnerable Software and Affected Versions OS4ED openSIS-Classic versions prior to 9.4 Description A security flaw in the Student Search component allows remote attackers to perform SQL injection. This occurs through the manipulation of the cust argument within the...

PT-2026-103096

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. CSRF is a flaw that allows an attacker to trick an authenticated user into performing actions they d...

PT-2026-103146

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO sort causes sql injection. The attack can be initiated remotely. The...

CVE-2026-102290

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

EUVD-2026-88641

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-102290 CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-102290 CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-102290

A vulnerability exists in CodeCanyon Rocket LMS up to version 2.2 . The issue resides in an unknown function within the Student Profile Image Upload component, where specific manipulations can lead to Cross-Site Scripting (XSS) . This attack can be executed remotely , and the exploit has been pub...

PT-2026-102451

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-102290: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

Leaky Students: Membership Inference against On-Policy Distillation

On-policy distillation OPD trains a student to match a teacher's next-token distributions on student-generated trajectories. However, privileged information supplied to the teacher for OPD training may contain sensitive data. Whether the student leaks private information about the records supplie...

CVE-2026-97884

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The...

CVE-2026-97884 mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The...