301 matches found
ls-poc
CVE-2026-30368 إثبات المفهوم !IMPORTANT تم تصحيح هذه الثغرة وتتطلب الآن بيانات اعتماد، استخدم الحل البديل لتنفيذ إجراءات على نفسك. مقدمة تسمح CVE-2026-30368 للمهاجم بالتحكم في أجهزة الطلاب عبر ثغرة ضعف في المصادقة في إدارة الفصول الدراسية Lightspeed Classroom. يقوم إثبات المفهوم poc.js بتنفيذ خدم...
CVE-2026-77010
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...
CVE-2026-77008
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...
CVE-2026-77007
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...
CVE-2026-77010
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) fails to perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classro...
EUVD-2026-68055
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...
CVE-2026-77008
CVE-2026-77008 affects the HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3 . The root cause is a missing authentication/authorization check on the plugin's settings-saving endpoint, allowing any unauthenticated user to overwrite the stored configuration. ...
CVE-2026-77008 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...
EUVD-2026-68056
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...
CVE-2026-77010 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...
EUVD-2026-68054
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...
CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...
CVE-2026-77007
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) contains a missing authorization check on one of its REST API routes . This allows unauthenticated users to retrieve the plugin's stored settings, including the shared secret used to sign API requests to the ...
PT-2026-83407
Name of the Vulnerable Software and Affected Versions HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 Description The plugin lacks authorization and authentication checks when saving settings. This allows unauthenticated users to overwrite configuration settings and...
EUVD-2026-48444
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-16765
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-16765
CodeAstro Online Classroom 1.0 contains a vulnerability in the file /OnlineClassroom/loginlinkadmin.php where manipulating the argument aid can trigger an SQL injection. The issue can be exploited remotely without authentication, and public exploit guidance exists. Affected component: loginlinkad...
CVE-2026-16765
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
PT-2026-64189
Name of the Vulnerable Software and Affected Versions CodeAstro Online Classroom version 1.0 Description Remote SQL injection is possible due to improper handling of the aid argument within the '/OnlineClassroom/loginlinkadmin.php' endpoint. SQL injection is a technique where an attacker inserts...