Cappriciosec-University

📚 Cappriciosec University — первая в Индии платформа электронного обучения для хакеров Cappriciosec University — это первая в Индии платформа электронного обучения для хакеров, новичков в кибербезопасности и охотников за баг-баунти. Мы специализируемся на этичном взломе, тестировании на...

FreeLabFriday_Labs

Бесплатные лаборатории пятницы Нужна 1 лаборатория?? Может, 2???? Ну, у нас их 200+, так что отрывайтесь! Этот репозиторий содержит все инструкции для лабораторных работ по следующим темам: Базовые навыки информационной безопасности Базовые навыки SOC Активная защита и киберобман Лаборатории...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Отсутствие авторизации у аутентифицированных Подписчик+ произвольное обновление метаданных пользователя Описание Плагин WP Courses LMS – Online Courses Builder, eLearning...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 Эксплойт Описание Этот репозиторий содержит эксплойт на Python, нацеленный на CVE-2021-36393, критическую уязвимость, обнаруженную в функции недавних курсов Moodle. Ошибка находится в параметре 'sort', что позволяет проводить атаки с использованием SQL-инъекций, которые могут...

CVE-2026-81197

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

CVE-2026-10630

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2026-10630 WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

WordPress WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Sensitive Information Disclosure vulnerability discovered by Vapour in WordPress Plugin WP Courses LMS versions = 3.2.29...

CVE-2026-10630

WP Courses LMS (WordPress plugin) is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.2.29 . The resultID parameter in the wpcq_get_quiz_result AJAX action lacks proper ownership validation, allowing authenticated users with custom-level access or above ...

EUVD-2026-65192

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

EUVD-2026-54306

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

EUVD-2026-52183

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

This innovative practice full paper examines the integration of technology-enhanced tabletop exercises TTXs into computing education, focusing on cybersecurity curricula. The motivation is to better prepare students for complex, collaborative problem solving typical of incident response and IT...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2026-39385

CVE-2026-39385 — Frappe LMS : Open-source LMS with a vulnerability in versions ≤ 2.51.0 where a user could bypass course payment validation by using an unrelated batch. Root cause: enrollment validation did not require the batch to be linked to the corresponding course. Impact: potential unauthor...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2026-13765

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the checkanswer. This makes it possible for unauthenticated attackers to extract the correct-answer markers...