12 matches found
CVE-2026-111603
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
CVE-2026-111603 PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
EUVD-2026-103025
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
CVE-2026-111603 PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
CVE-2026-111603
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
CVE-2026-111603
PlayEdu versions through 2.3 are affected by a missing authorization vulnerability within the CourseController . The root cause is the omission of a department visibility check , which allows authenticated students to access department-restricted courses. Attackers can perform ID enumeration on s...
CVE-2026-111603 PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
CVE-2026-111603: Authorization Bypass Through User-Controlled Key
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
PT-2026-116002
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...
PlayEdu authorization issue vulnerability
PlayEdu versions 2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification in the CourseController. It allows authenticated students to access restricted courses by bypassing department visibility checks. Additionally, it enables...
Stored cross-site scripting vulnerability in the study function on the YxtCMF CourseController.class.php page
YxtCMF Yi Xue Tang Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. A stored cross-site scripting vulnerability exists in the study function on the YxtCMF CourseController.class.php page. An attacker can insert malicious js code into...
Arbitrary file download vulnerability in the downmaterial function on the YxtCMF CourseController.class.ph page
YxtCMF Yi Xue Tang Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. An arbitrary file download vulnerability exists in the YxtCMF CourseController.class.ph page downmaterial function. Allows an attacker to exploit the vulnerability t...