CVE-2026-11773: Missing Authorization

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-5167: Authorization Bypass Through User-Controlled Key

The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handlewebhook function. The...

EUVD-2025-16404

Malicious code in bioql PyPI...

CVE-2025-48336

Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through 3.6.6...

CVE-2025-48336 WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through 3.6.6...

CVE-2025-48336 WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through 3.6.6...

CVE-2025-48336

The provided data confirms CVE-2025-48336 affects the WordPress theme Course Builder (ThimPress Course Builder) with a Deserialization of Untrusted Data vulnerability that enables PHP Object Injection in versions prior to 3.6.6. Root cause: untrusted data deserialization leading to object injecti...

WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Cút lộn xào me Patchstack Alliance in WordPress Theme Course Builder versions 3.6.6...

course-builder 代码问题漏洞

course-builder is an open source application from Overdrive Eletrônica. A code issue vulnerability exists in course-builder versions prior to 3.6.6 that stems from deserializing untrusted data, which could lead to object injection...

WordPress Course Builder Theme < 3.6.6 is vulnerable to PHP Object Injection

Software Course Builder Type Theme Vulnerable versions 3.6.6 Fixed in 3.6.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-48336 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 330f3e0387ca Credits Annn Required privilege Unauthenticated...

CVE-2025-48336: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through 3.6.6...

PT-2025-23196 · Thimpress · Thimpress Course Builder

Name of the Vulnerable Software and Affected Versions: ThimPress Course Builder versions prior to 3.6.6 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited due to the deserialization of untrusted data, potentially leading to...

CVE-2024-10000 Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-10008: Missing Authorization

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes ...

CVE-2024-10000: Improper Neutralization of Input During Web Page Generation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2015-10049

A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched...

Cross site scripting

A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched...

CVE-2015-10049 Overdrive Eletrônica course-builder oeditor.html cross site scripting

A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched...

CVE-2015-10049

The CVE-2015-10049 entry describes a Cross-Site Scripting vulnerability in Overdrive Eletrônica course-builder, affecting versions up to 1.7.x. The issue involves unknown functionality in the file coursebuilder/modules/oeditor/oeditor.html being manipulated to trigger XSS, with remote exploit via...

Overdrive Eletrônica course-builder 跨站脚本漏洞

course-builder is an open source application from Overdrive Eletrônica. A cross-site scripting vulnerability exists in Overdrive Eletrônica course-builder versions prior to 1.8.0, which stems from some unknown functionality in the file coursebuilder/modules/oeditor/oeditor.html, which is...