EUVD-2022-5466

Malicious code in bioql PyPI...

EUVD-2024-44942

Malicious code in bioql PyPI...

EUVD-2023-39127

Malicious code in bioql PyPI...

EUVD-2022-3494

Malicious code in bioql PyPI...

EUVD-2023-39124

Malicious code in bioql PyPI...

PT-2025-39153

🗣️ CVE-2025-9125: Cross-Site Scripting Flaw in Lectora Courses Puts E-Learning Platforms at Risk https://t.co/EeMX3DPpeO...

Cross-site scripting vulnerability in Lectora course navigation

Overview Lectora Desktop versions 21.0–21.3 and Lectora Online versions 7.1.6 and older contained a cross-site scripting XSS vulnerability in courses published with Seamless Play Publish SPP enabled and Web Accessibility disabled. The vulnerability was initially patched in Lectora Desktop version...

Linux Distros Unpatched Vulnerability : CVE-2021-36393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. CVE-2021-36393 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2021-20283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each...

Linux Distros Unpatched Vulnerability : CVE-2017-7531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 3.3, the course overview block reveals activities in hidden courses. CVE-2017-7531 Note that Nessus relies on the presence of the package as reported ...

bassant-courses-manager (>=1.0.1, <=1.0.5), dxtest1 (>=1.0.0, <=1.0.2) +3 more potentially affected by unknown CVE via commender (0.0.1-security)

commender NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on commender and may be impacted: - bassant-courses-manager =1.0.1, =1.0.0, =1.0.0, =1.0.1 - xy-xueyong-rkc 1.0.0 - zansanfeng123 1.0.0 Source cves: unknown CVE Source...

CVE-2021-24707

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24621

The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfilteredhtml capability is disallowed, which could lead to Stored Cross-Site Scripting issues...

CVE-2020-26876

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...

Security Science (SecSci), Basic Concepts and Mathematical Foundations

This textbook compiles the lecture notes from security courses taught at Oxford in the 2000s, at Royal Holloway in the 2010s, and currently in Hawaii. The early chapters are suitable for a first course in security. The middle chapters have been used in advanced courses. Towards the end there are...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

CVE-2024-56883 affects Sage DPW prior to 2024_12_001. The issue is improper server-side access control: RBAC is not consistently enforced, allowing low-privilege employee-role users to create external courses for others by tampering the id parameter in a create request. Impact is elevated access ...

CVE-2024-50529

Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through = 2.0.1...

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...