CVE-2021-39181

OpenOlat is a web-based learning management system LMS. Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file e.g. a course any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the...

Design/Logic Flaw

OpenOlat is a web-based learning management system LMS. Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file e.g. a course any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the...

CVE-2021-39181 Unsafe Deserialization of User Data Using XStream

OpenOlat is a web-based learning management system LMS. Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file e.g. a course any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-39180

OpenOLAT is affected by a path traversal vulnerability (CVE-2021-39180) in versions before 15.3.18, 15.5.3, and 16.0.0. An attacker with an OpenOLAT user account can upload a specially crafted ZIP and trigger unzip, enabling overwriting files writable by the application server user (e.g., Tomcat)...

CVE-2021-37391

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

SourceCodester Learning Management System File Upload Vulnerability

SourceCodester Learning Management System is an online learning management system from SourceCodester, Inc. in the United States. A file upload vulnerability exists in SourceCodester Learning Management System, which can be exploited by an attacker to execute arbitrary code...

CVE-2021-25200

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

CVE-2021-25200

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

SourceCodester Learning Management System 代码问题漏洞

SourceCodester Learning Management System is an online learning management system from SourceCodester, Inc. in the United States. A file upload vulnerability exists in SourceCodester Learning Management System, which can be exploited by an attacker to execute arbitrary code...

CVE-2021-25200

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

CVE-2021-25200

CVE-2021-25200 represents an arbitrary file upload vulnerability in SourceCodester Learning Management System v1.0. The flaw allows an attacker to upload to lms/student_avatar.php, enabling arbitrary code execution. Affected product: SourceCodester LMS 1.0. Root cause: improper validation of file...

CVE-2021-25201

SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information...

CVE-2021-25201

SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information...

Sql injection

SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information...

CVE-2021-25201

SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information...

CVE-2021-25201

CVE-2021-25201 corresponds to an SQL injection vulnerability in Learning Management System v1.0 where the id parameter is exploited to execute arbitrary SQL and potentially expose sensitive database information. Multiple connected sources corroborate the issue and its impact; no details on affect...

Forma Learning Management System SQL注入漏洞

Forma Learning Management System LMS is a Learning Management System LMS. A security vulnerability exists in Learning Management System v 1.0, which can be exploited by remote attackers to execute arbitrary SQL statements via the id parameter and obtain sensitive database information...

Chamilo SQL Injection Vulnerability

Chamilo is a learning management system focused on ease of use and accessibility. A SQL injection vulnerability exists in main/inc/ajax/model.ajax.php in Chamilo 1.11.14 and earlier versions. The vulnerability can be exploited by an attacker to conduct a SQL injection attack via the searchField,...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-59602)

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Membership & Learning Management System Plugin for WordPress plugin prior to version 4.21.1, which stems from the plugin generating...