4972 matches found
CVE-2026-78284: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
CVE-2026-19093
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-14187
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
EUVD-2026-64220
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-19093
The Tutor LMS WordPress plugin, in versions prior to 4.0.6 , is vulnerable to an Arbitrary File Read vulnerability. The root cause is a failure to validate stored file paths before using them to stream media. This allows users with the instructor role to read arbitrary files on the server, includ...
EUVD-2026-64215
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-14187
The Tutor LMS WordPress plugin versions before 4.0.6 is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the plugin fails to enforce per-object ownership checks on its course content type. This allow users with the instructor role to unauthorizedly read the conte...
CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
WordPress Tutor LMS plugin < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure vulnerability
Instructor+ Cross-Instructor Private Course Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Tutor LMS versions 4.0.6...
PT-2026-79511
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to validate a stored file path used for streaming media. This allows users with the instructor role to perform an arbitrary file read on the server, including files located outside...
PT-2026-79506
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other...
CVE-2026-19093: Files or Directories Accessible to External Parties
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-14187: Authorization Bypass Through User-Controlled Key
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
WordPress Masteriyo LMS plugin < 2.3.3 - Instructor+ Stored XSS via Quiz Description vulnerability
Instructor+ Stored XSS via Quiz Description vulnerability discovered by Farid Narimanov in WordPress Plugin Masteriyo - LMS versions 2.3.3...
CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...