3764 matches found
CVE-2025-34031
Summary: CVE-2025-34031 affects Moodle LMS Jmol Plugin, version 6.1 and earlier. The vulnerability is a local/file path traversal in the jsmol.php endpoint: user input is passed directly to file_get_contents(), enabling reading arbitrary files from the server when the parameter is crafted. No aut...
PT-2025-26658 · Moodle · Moodle Lms Jmol Plugin
Name of the Vulnerable Software and Affected Versions: Moodle LMS Jmol plugin versions 6.1 and prior Description: A path traversal vulnerability exists in the Moodle LMS Jmol plugin via the query parameter in jsmol.php. The script directly passes user input to the file get contents function witho...
PT-2025-26659 · Moodle · Moodle Lms Jmol Plugin
Name of the Vulnerable Software and Affected Versions: Moodle LMS Jmol plugin versions 6.1 and prior Description: A reflected cross-site scripting XSS issue exists due to the application's failure to properly sanitize user input before embedding it into the HTTP response. This allows an attacker ...
WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability
Reflected Cross Site Scripting XSS Vulnerability discovered by Cút lộn xào me in WordPress Theme LMS versions = 9.2...
WordPress LMS Theme <= 9.1 is vulnerable to Cross Site Scripting (XSS)
Software LMS Type Theme Vulnerable versions = 9.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-52799 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fe340a188e96 Credits Ann Required privilege Unauthenticated Published ...
The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of verification of the validity of XML objects’ sequences. This allows attackers to execute arbitrary SQL queries.
The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of verification of the validity of XML objects’ sequences. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary SQL queries...
The vulnerability of the Chamilo LMS system for electronic learning and content management lies in the insufficient verification of incoming requests used by the operating system. This allows attackers to execute arbitrary HTTP requests.
The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the insufficient verification of incoming requests used by the operating system. Exploiting this vulnerability could allow a malicious actor to execute arbitrary HTTP requests remotely...
The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of verification of the validity of XML objects’ sequences. This allows attackers to execute arbitrary SQL queries.
The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of verification of the validity of XML objects’ sequences. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary SQL queries...
How LMS Software Supports Secure Online Employee Learning
Explore how learning management systems LMS software supports safe online learning, protects employee data, and ensures compliance in…...
CVE-2025-4800
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2025-4800 MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2025-4800 MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2025-4800
CVE-2025-4800 — MasterStudy LMS Pro (WordPress) Vulnerability: Arbitrary file upload due to missing file-type validation in stm_lms_add_assignment_attachment. Affected: MasterStudy LMS Pro plugin for WordPress versions up to and including 4.7.0. Impact: Authenticated attackers with Subscriber-lev...
PT-2025-23049 · WordPress · Masterstudy Lms Pro
Name of the Vulnerable Software and Affected Versions: MasterStudy LMS Pro plugin for WordPress versions up to, and including, 4.7.0 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm lms add assignmen...
WordPress MasterStudy LMS Pro plugin <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin MasterStudy LMS Pro versions = 4.7.0...
15,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in MasterStudy LMS Pro WordPress Plugin
📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On May 15th, 2025, we received a submission for an Arbitrary File Upload...
CVE-2025-22334
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7...
CVE-2024-43990
Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8...
CVE-2024-25270
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference IDOR vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data...