Cross site scripting

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

CVE-2021-37390

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

CVE-2021-37390

CVE-2021-37390 affects Chamilo LMS 1.11.14, where a reflected XSS vulnerability exists in the social search feature (main/social/search.php?q). The issue stems from input handling in the social/search path, enabling injection that could affect users who load the vulnerable page. Public references...

CVE-2021-37390

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

CVE-2021-37391

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

CVE-2021-37391

Summary: CVE-2021-37391 affects Chamilo LMS 1.11.14, with a stored XSS in the social/invite flow. A user without privileges can send an invitation via main/social/search.php and main/inc/lib/social.lib.php, enabling an attacker to steal cookies or execute arbitrary code on the administration side...

CVE-2021-37391

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

PT-2021-3968

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.14 Description The issue allows a user without privileges to send an invitation message to another user, such as the administrator, through main/social/search.php and main/inc/lib/social.lib.php, potentially stealing...

PT-2021-21630

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.14 Description A reflected XSS issue exists in the social network search feature, specifically in the "main/social/search.php" endpoint with the q URI parameter. This allows for potential exploitation. Recommendations...

CVE-2021-37390: Improper Neutralization of Input During Web Page Generation

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

CVE-2021-37391: Improper Neutralization of Input During Web Page Generation

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

WordPress Tutor LMS plugin <= 1.9.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Tutor LMS plugin versions = 1.9.5. Solution Update the WordPress Tutor LMS plugin to the latest available version at least 1.9.6...

Tutor LMS < 1.9.6 - Reflected Cross-Site Scripting

The plugin does not escape a page parameter before outputting it back in an student dashboard page, leading to a Reflected Cross-Site Scripting issue alert/XSS/' /...

Tutor LMS < 1.9.6 - Reflected Cross-Site Scripting

The plugin does not escape a page parameter before outputting it back in an student dashboard page, leading to a Reflected Cross-Site Scripting issue PoC...

CVE-2021-24504

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any use...

CVE-2021-24504

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any use...

CVE-2021-24455

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered...

CVE-2021-24455

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered...

Cross site scripting

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered...

Cross site request forgery (csrf)

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any...