CVE-2021-24186

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24181

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24183

The tutorquizbuildergetquestionform AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

Sql injection

The tutorplacerating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

Sql injection

The tutorquizbuildergetquestionform AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24182 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutorquizbuildergetanswersbyquestion AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24181 Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24185 Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutorplacerating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24184

CVE-2021-24184 affects Tutor LMS (WordPress plugin) versions before 1.7.7. The vulnerability is due to unprotected AJAX endpoints that allow students to modify course information and elevate privileges, among other actions. Impact includes privilege escalation and alteration of course data. The i...

CVE-2021-24186

The CVE-2021-24186 vulnerability affects the Tutor LMS WordPress plugin (pre-1.8.3), where the tutor_answering_quiz_question/get_answer_by_id function pair is susceptible to UNION-based SQL injection. The flaw could allow an attacker (e.g., students) to inject SQL via the affected endpoint, enabl...

CVE-2021-24183 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form

The tutorquizbuildergetquestionform AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24182

CVE-2021-24182 affects the Tutor LMS WordPress plugin prior to 1.8.3. The flaw is a UNION-based SQL injection in the AJAX action tutor_quiz_builder_get_answers_by_question, exploitable by students. The vulnerability stems from unsafely constructed SQL in the affected function, enabling unauthoriz...

CVE-2021-24181

The CVE covers Tutor LMS (WordPress plugin) prior to version 1.7.7, where the tutor_mark_answer_as_correct AJAX action is vulnerable to blind and time-based SQL injections. This could enable an attacker (e.g., students) to manipulate queries via that action. Affected component: Tutor LMS WordPres...

CVE-2021-24185

The CVE-2021-24185 affects the Tutor LMS WordPress plugin prior to version 1.7.7. The vulnerability lies in the tutor_place_rating AJAX action, where blind and time-based SQL injections allow exploitation by a student attacker. Impact, as stated, is exposure of data through SQL injection; exploit...

CVE-2021-24184 Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

CVE-2021-24186 Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The plugin is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file https://your.domain/wp-admin/admin.php?page=tutor-tools&subpage=..%2F..%2F..%2F..%2F..%2F..%2Find...

Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The plugin is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file PoC https://your.domain/wp-admin/admin.php?page=tutor-tools⊂page=..%2F..%2F..%2F..%2F..%2F..%2Fin...

WordPress Tutor LMS plugin <= 1.8.7 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by sasa in WordPress Tutor LMS plugin versions = 1.8.7 Solution Update the WordPress Tutor LMS plugin to the latest available version at least 1.8.8...

Security Bulletin: IBM Kenexa LMS On Premise -[All] jQuery (Publicly disclosed vulnerability) - 180875

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details Third Party Entry: 180875 DESCRIPTION: jQuery cross-site scripting CVSS Base score: 6.1 CVSS Temporal Score: See...