CVE-2026-14306

CVE-2026-14306 affects Tutor LMS for WordPress, prior to version 3.9.14. The vulnerability is an enrollment check bypass that allows authenticated users with subscriber-level access (or higher) who are enrolled in at least one course to view paid lesson, quiz, and assignment content from other co...

CVE-2026-14310

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-14310 Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-14310

CVE-2026-14310 affects the Tutor LMS WordPress plugin, version prior to 4.0.0. The vulnerability arises because the plugin does not properly verify that a user has access to the course associated with a Q&A thread before returning or writing to that thread. This enables authenticated users with s...

CVE-2026-14310

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-14207

CVE-2026-14207 affects the LifterLMS WordPress plugin prior to 10.0.10. The root cause is that event-handler attributes in a course pricing field are not stripped before storage/rendering, allowing users with a course-editing role to inject JavaScript that executes in an administrator’s session w...

CVE-2026-63240

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

EUVD-2026-50135

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

CVE-2026-63240

Technical details (affected software/versions, root cause, fix) are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-63240 Information disclosure vulnerability

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

CVE-2026-63240

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

PT-2026-65711

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

PT-2026-65712

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-34239

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-34239 Chamilo Authenticated Remote Code Execution

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-39385

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...