CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

CVE-2022-28986

CVE-2022-28986 A Insecure direct object references IDOR vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Critical Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Insecure direct object...

CVE-2026-22241

🚨 CVE-2026-22241 - Open eClass Theme Import Remote Code Execution 📌 Vulnerability Summary Open eClass also known as GUnet eClass, a widely used open-source Learning Management System LMS, contains a critical Unrestricted File Upload vulnerability in its Theme Import feature. An authenticated...

CVE-2023-4220-PoC

CVE-2023-4220 Arbitrary File Upload / RCE - PoC I created this script to automate the exploitation of CVE-2023-4220 and obtain a reverse shell on the Hack The Box PermX machine. This vulneraibilitie affects Chamilo LMS versions ≤ 1.11.24 , due to insufficient validation in the big upload...

chamilo-lms-unauthenticated-rce-poc

Chamilo LMS Unauthenticated RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependenci...

CVE-2026-1375

CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - Missing Authorization to Authenticated Student+ Privilege Escalation to Administrator 🔴 Vulnerability Overview CVE-2026-4484 — Authenticated Privilege Escalation Student → Administrator Description: The Masteriyo LMS plugin for WordPress is vulnerable to...

CVE-2026-31282

CVE-2026-31282 Description Totara LMS is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form and bypass Octa login. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack to obtain a user credentials...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2023-4220-Chamilo-LMS

Chamilo LMS Unauthenticated Big Upload File RCE PoC This script allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependencies using pip...

CVE-2024-34225

Sistema de Gestión de Laboratorio de Computación usando PHP y MySQL 1.0 Remitente: Kha Do Vulnerabilidad Cross Site Scripting Descripción Vulnerabilidad de Secuencias de comandos entre sitios en php-lms/admin/?page=systeminfo en el Sistema de Gestión de Laboratorio de Computación usando PHP y MyS...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2023-4226

🛠️ Exploitation CVE-2023-4226 for Chamilo LMS 📋 Description Python script that automates the exploitation of CVE-2023-4226 , an unrestricted file upload vulnerability in Chamilo LMS = v1.11.24. Uploads a PHP web shell based on PentesterMonkey and configures .htaccess to achieve a reverse shell...

CVE-2023-4278

CVE-2023-4278 !\vulnerable.png./vulnerable.png root@kitploit: Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/...

CVE-2023-45878

CVE-2023-45878 Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell...

CVE-2023-4220

CVE-2023-4220 RCE Chamilo 1.11.24 | https://starlabs.sg/advisories/23/23-4220/ | | Chamilo LMS /tmp/rce.php EOF curl -F 'bigUploadFile=@/tmp/rce.php' "$HOST/$URLUPLD" CMD=$echo $CMD|base64 -w0| python3 -c "import urllib.parse,sys; printurllib.parse.quoteplussys.stdin.read" curl...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS Unauthenticated Big Upload File RCE This repository contains a Proof of Concept PoC for CVE-2023-4220 , a Remote Code Execution RCE vulnerability affecting Chamilo LMS. This vulnerability allows unauthenticated attackers to exploit a large file upload feature, leadin...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · OS Command Injection → RCE Researcher: K Disclosure Type: Responsible Disclosure Status: Patched Affected Product: Chamilo LMS 2.0 Confirmed on v1.11.32 📋 Vulnerability Summary...

ChamiloLMS-CVE-2023-4220

ChamiloLMS CVE-2023-4220 Exploit Python exploit for CVE-2023-4220 , an unauthenticated arbitrary file upload vulnerability affecting Chamilo LMS = 1.11.24. The vulnerability is located in Chamilo's BigUpload component. On vulnerable installations, the upload handler allows a PHP file to be upload...

CVE-2022-0441

CVE-2022-0441 root@kitploit: Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Date: 16.02.2022 Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 Instalación...