CVE-2023-25431

An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer0/admins/assessments/course/course-update.php...

PT-2023-20057 · Unknown · Online Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Online Reviewer Management System version 1.0 Description: An issue was discovered in the Online Reviewer Management System, where there is a XSS vulnerability. This vulnerability can be exploited via the reviewer...

PT-2023-20058 · Unknown · Online Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Online Reviewer Management System version 1.0 Description: An issue was discovered in the Online Reviewer Management System, where a SQL injection can directly issue instructions to the background database system via the "reviewer...

Namaste! LMS < 2.6 - Admin+ Stored XSS

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. One XSS issue was fixed in version 2.5.9.9. The...

SUSE CVE-2008-3327

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

SUSE CVE-2009-4305

SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file CourseTitle."...

SUSE CVE-2010-1616

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability...

SUSE CVE-2010-1617

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page...

SUSE CVE-2015-3180

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

SUSE CVE-2016-3733

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber...

SUSE CVE-2016-5014

In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course...

SUSE CVE-2016-8644

In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context...

SUSE CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

SUSE CVE-2017-7491

In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting...

SUSE CVE-2017-7532

In Moodle 3.x, course creators are able to change system default settings for courses...

SUSE CVE-2017-7531

In Moodle 3.3, the course overview block reveals activities in hidden courses...

SUSE CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

Future-Depth Institutional Management Website 代码问题漏洞

Future-Depth Institutional Management Website is a user-friendly institutional website from the individual developers at Future-Depth that offers various types of courses for students. A security vulnerability exists in Future-Depth Institutional Management Website IMS version 1.0. An attacker...

An ever green, ever great way to learn Spring

I could do this post every week. Wait, I do do this post every week! It's called This Week in Spring, and in it I recap a lot of interesting new bits of content on the internet that elaborate or introduce or innovate. I love those points of data. They help. But they're almost never a full-guided...

Autolab path traversal vulnerability

Autolab is a course management service. Autolab supports automatic grading of programming assignments. a path traversal vulnerability exists in Autolab. An attacker could exploit this vulnerability to view the contents of a file...