EUVD-2022-5466

Malicious code in bioql PyPI...

EUVD-2022-3494

Malicious code in bioql PyPI...

EUVD-2023-39127

Malicious code in bioql PyPI...

PT-2025-39153

Name of the Vulnerable Software and Affected Versions Lectora affected versions not specified Description A cross-site scripting flaw exists in Lectora courses, potentially impacting e-learning platforms. The issue allows for the injection of malicious scripts into web pages viewed by users. This...

Cross-site scripting vulnerability in Lectora course navigation

Overview Lectora Desktop versions 21.0–21.3 and Lectora Online versions 7.1.6 and older contained a cross-site scripting XSS vulnerability in courses published with Seamless Play Publish SPP enabled and Web Accessibility disabled. The vulnerability was initially patched in Lectora Desktop version...

Linux Distros Unpatched Vulnerability : CVE-2021-36393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. CVE-2021-36393 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2021-20283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each...

Linux Distros Unpatched Vulnerability : CVE-2017-7531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 3.3, the course overview block reveals activities in hidden courses. CVE-2017-7531 Note that Nessus relies on the presence of the package as reported ...

bassant-courses-manager (>=1.0.1, <=1.0.5), dxtest1 (>=1.0.0, <=1.0.2) +3 more potentially affected by unknown CVE via commender (0.0.1-security)

commender NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on commender and may be impacted: - bassant-courses-manager =1.0.1, =1.0.0, =1.0.0, =1.0.1 - xy-xueyong-rkc 1.0.0 - zansanfeng123 1.0.0 Source cves: unknown CVE Source...

CVE-2025-5214: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /courses/coursedetailusernew.php. The manipulation of the argument ID leads to sql injection. The attack may be launched...

CVE-2021-24707

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24621

The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfilteredhtml capability is disallowed, which could lead to Stored Cross-Site Scripting issues...

CVE-2020-26876

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...

Security Science (SecSci), Basic Concepts and Mathematical Foundations

This textbook compiles the lecture notes from security courses taught at Oxford in the 2000s, at Royal Holloway in the 2010s, and currently in Hawaii. The early chapters are suitable for a first course in security. The middle chapters have been used in advanced courses. Towards the end there are...

CVE-2025-2290: Missing Authorization

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the deleteaccessplan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883: Improper Access Control

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW versions prior to 2024_12_001 are vulnerable to an Incorrect Access Control flaw. The software fails to consistently enforce role-based access controls on the server side, allowing low-privileged users with employee roles to create external courses for other employees. This is achieved b...

CVE-2024-50529

Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through = 2.0.1...

CVE-2024-12596: Missing Authorization

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llmsdeletecert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with...