34 matches found
WordPress Tutor LMS plugin <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters vulnerability
Reflected Cross-Site Scripting via 'backurl' and 'search' Parameters vulnerability discovered by Filip Kowalski Agentunio in WordPress Plugin Tutor LMS versions = 4.0.8...
CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-89081
The Tutor LMS WordPress plugin (eLearning and online course solution) is affected by Reflected Cross-Site Scripting (XSS) via the 'search' parameter in all versions up to and including 4.0.8 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can in...
EUVD-2015-8356
Malware in sbrugna...
EUVD-2014-2037
Malware in sbrugna...
EUVD-2020-23848
Malware in sbrugna...
EUVD-2006-2478
Malware in sbrugna...
CVE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
SUSE CVE-2014-1985
Open redirect vulnerability in the redirectbackordefault function in app/controllers/applicationcontroller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url backurl parameter...
CVE-2022-41679
Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “backurl” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to...
Cross site scripting
Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “backurl” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to...
CVE-2022-41679 Cross-site scripting in Forma LMS version
Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “backurl” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to...
CVE-2022-41679: Improper Neutralization of Input During Web Page Generation
Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “backurl” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to...
The vulnerability of the file scan component in the FortiSandbox system, which is used for threat detection and remediation, allows a perpetrator to execute arbitrary code.
The vulnerability of the file scan component in the FortiSandbox threat detection and mitigation system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through the backurl parameter...
Cross-site Scripting (XSS)
Redmine is vulnerable to cross-site scripting. An attacker is able to inject malicious script via the backurl field...
DEBIAN-CVE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
CVE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
CVE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
