CVE-2020-12112

CVE-2020-12112 🚨 Версии BigBlueButton ниже 2.2.4 содержат уязвимость LFI, позволяющую получить доступ к конфиденциальным файлам. История 📜 Во время курса дистанционного обучения на экземпляре BigBlueButton один из студентов моего курса поделился ссылкой на слайд-презентацию моего преподавателя, и...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure vulnerability

Unauthenticated BigBlueButton API Secret Disclosure vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions

PT-2026-83406

Name of the Vulnerable Software and Affected Versions HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 Description The plugin fails to perform authorization checks on a REST API route. This allows unauthenticated users to retrieve stored settings, which include the share...

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55491

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...

CVE-2026-46355

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...

CVE-2026-46682

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

EUVD-2026-63683

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489

BigBlueButton (open-source virtual classroom) is vulnerable to an IDOR (Insecure Direct Object Reference) in its presentation deletion handler. Prior to 3.0.29 , the file RemovePresentationPubMsgHdlr.scala did not verify that a submitted presentationId belonged to the same meeting before performi...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...

CVE-2026-55491

BigBlueButton versions prior to 3.0.29 have a stored XSS flaw: the meetingName field is rendered unescaped in record-and-playback/screenshare/playback/index.html.erb, so a low-privileged user can inject script that runs when another user replays the recording. CVSS 3.1 scores 5.4 (Medium). Upgrad...

CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...