34 matches found
CVE-2026-31281
CVE-2026-31281 Descripción Totara LMS es vulnerable a inyección HTLM. Un atacante puede inyectar código HTLM malicioso en un mensaje y enviarlo a todos los usuarios de la aplicación, lo que resulta en la ejecución del código y puede llevar al secuestro de sesión y a la ejecución de comandos en el...
CVE-2026-31283
CVE-2026-31283 Descripción La función de contraseña olvidada puede utilizarse para lanzar un ataque de bombardeo de correo electrónico a un correo de la víctima. Puntuación CVSS 3: 7.5 Alta Tipo de ataque Remoto No autenticado Versiones afectadas Versiones anteriores a 19.1.5 Descubierto por: Yaz...
CVE-2026-31282
CVE-2026-31282 Descripción Totara LMS es vulnerable a un Control de Acceso Incorrecto. El código de la página de inicio de sesión puede manipularse para revelar el formulario de inicio de sesión y omitir el inicio de sesión de Octa. Un atacante puede encadenar esto con la falta de limitación de...
CVE-2026-31281
Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser. NOTE: The...
CVE-2026-31282
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
CVE-2026-31283
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a ha...
CVE-2026-31282
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
CVE-2026-31282
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
PT-2026-32358
Totara LMS v19.1.5 and before is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser...
CVE-2026-31281
Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser. NOTE: The...
CVE-2026-31283
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a ha...
CVE-2026-31282: Improper Access Control
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
CVE-2026-31283: Allocation of Resources Without Limits or Throttling
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a ha...
CVE-2026-31283
The Totara LMS (versions v19.1.5 and before ) is vulnerable to an Email Bombing attack due to a lack of rate limiting on the forgot password API for target email addresses. An unauthenticated remote attacker can exploit this to send multiple reset requests. While the supplier notes that a pwreset...
CVE-2026-31282
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
CVE-2026-31282
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because 1 local log...
EUVD-2024-32498
Malicious code in bioql PyPI...
EUVD-2024-32499
Malicious code in bioql PyPI...
CVE-2024-3932
A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Selector. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...
CVE-2024-3931
A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/roles/check.php of the component User Selector. The manipulation of the argument ID Number leads to cross site scripting. The attack may be...