5331 matches found
CVE-2024-37256 WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1...
CVE-2024-37256
The CVE-2024-37256 entry concerns a SQL Injection in the WordPress Tutor LMS plugin (versions
CVE-2024-5648
CVE-2024-5648: LearnDash LMS – Reports (WordPress) up to v1.8.2 allows authenticated users with Subscriber+ to modify plugin settings due to a missing capability check; CVSS v3.1 base score 5.4 (Medium). Public technical details beyond this (fix/patch) are not provided in the connected documents.
CVE-2024-5648 LearnDash LMS - Reports Free <= 1.8.2 - Missing Authorization to Plugin Settings Update
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2024-5648 LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions i.e. wrldsetconfiguration, wrldexcludesettingssave, applytimetrackingsettings, wpajaxwrldgutenbergblockvisit, etc.. in all versions up to, and...
WordPress LearnDash LMS – Reports Plugin <= 1.8.2 is vulnerable to Broken Access Control
Software LearnDash LMS – Reports Type Plugin Vulnerable versions = 1.8.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5648 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 36a198e999f6 Credits Lucio Sá Required...
CVE-2024-38959
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...
PT-2024-27420
Name of the Vulnerable Software and Affected Versions Tutor LMS versions n/a through 2.7.1 Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting malicious SQL...
WordPress plugin Tutor LMS path traversal vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...
WordPress plugin LearnDash LMS security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...
CVE-2024-38959
The Creativeitem Academy LMS Learning Management System version v.6.8.1 is affected by a Cross-Site Scripting (XSS) vulnerability. A remote attacker can exploit this flaw by targeting a string parameter to execute arbitrary code and access sensitive information. No specific remediation steps or e...
CVE-2024-5648: Missing Authorization
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions i.e. wrldsetconfiguration, wrldexcludesettingssave, applytimetrackingsettings, wpajaxwrldgutenbergblockvisit, etc.. in all versions up to, and...
PT-2024-28293
Name of the Vulnerable Software and Affected Versions Creativeitem Academy LMS Learning Management System version 6.8.1 Description The issue allows a remote attacker to execute arbitrary code and obtain sensitive information. This is achieved via the string parameter. Recommendations For version...
CVE-2024-38959
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...
WordPress plugin Tutor LMS SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
CVE-2024-37256: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1...
CVE-2024-37266: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1...
CVE-2024-38959: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...
PT-2024-27431 · Themeum · Tutor Lms
Name of the Vulnerable Software and Affected Versions: Tutor LMS versions n/a through 2.7.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in Themeum Tutor LMS. This vulnerability allows Path...
