CVE-2024-3942

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticate...

CVE-2024-3553: Missing Authorization

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable us...

CVE-2024-3994: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutorinstructorlist' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2024-1463

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-18067 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the Course, Lesson, and Quiz title and...

CVE-2024-2938

A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /adminpanel/admin/faceboxmodal/updateCourse.php. The manipulation of the argument id leads to sql injection. The attack may be initiated...

Online Examination System SQL注入漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A SQL injection vulnerability exists in Online Examination System version 1.0, which originates from a SQL injection vulnerability in the parameter id of the file...

Online Examination System 安全漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A security vulnerability exists in Online Examination System version 1.0, which originates from a cross-site scripting XSS vulnerability in the parameter id of file...

Online Examination System SQL注入漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A SQL injection vulnerability exists in Online Examination System version 1.0, which originates from a SQL injection vulnerability in the id parameter of the...

CVE-2024-1751

Tutor LMS for WordPress is affected by a time-based SQL Injection in the question_id parameter in all versions up to 2.6.1, exploitable by authenticated users with subscriber or higher privileges to extract data. The root cause is insufficient escaping/protection in the SQL query. A fix is availa...

CVE-2024-1505

CVE-2024-1505 affects the Academy LMS plugin for WordPress (

CVE-2024-1751: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the questionid parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2024-1503: Cross-Site Request Forgery (CSRF)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erasetutordata function. This makes it possible for unauthenticated...

CVE-2024-1502: Missing Authorization

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutordeleteannouncement function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with...

BIT-MOODLE-2020-1692

Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course...

BIT-MOODLE-2021-36393

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses...

BIT-MOODLE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

BIT-MOODLE-2023-1402 Moodle: course participation report shows roles the user should not see

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view...

BIT-MOODLE-2023-5547 Moodle: xss risk when previewing data in course upload tool

The course upload preview contained an XSS risk for users uploading unsafe data...

February 2024: Vulremi, Vuldetta, PT VM Course relaunch, PT TrendVulns digests, Ivanti, Fortinet, MSPT, Linux PW

February 2024: Vulremi, Vuldetta, PT VM Course relaunch, PT TrendVulns digests, Ivanti, Fortinet, MSPT, Linux PW. Hello everyone! In this episode, I will talk about the February updates of my open source projects, also about projects at my main job at Positive Technologies and interesting...