2695 matches found
CVE-2025-70899
此仓库包含演示 PHPgurukul 在线课程注册系统中缺失 CSRF 防护漏洞的概念验证（PoC）。 📄 在此查看完整的 PoC： MissingCSRFprotectionpoc.md...
cve-2014-6271-huan-lu
cve-2014-6271-huan-lu 阅读课程...
WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure vulnerability
Subscriber+ Cross-Course Quiz Answer Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...
apache-struts-cve-2017-5638-project
apache-struts-cve-2017-5638-project Proyecto del curso de Ataque y Defensa centrado en el análisis, explotación y mitigación de CVE-2017-5638...
CVE-2020-14321
Python 脚本用于利用 CVE-2020-14321 - Moodle 3.9 课程注册允许从教师角色提权为管理者角色以执行远程代码。 某课程的教师可以在此课程中将自己分配为管理者角色。 Payload 来源：https://github.com/HoangKien1020/CVE-2020-14321 使用方法 如果你有有效的教师凭据（现实生活中尚未充分测试，也可能已经测试过，谁知道呢：P）： ❭ python3 CVE-2020-14321RCE.py http://moodle.site.com/moodle -u lanz -p 'Lanz123$!' 如果你有有效的教师...
CVE-2025-22785
CVE-2025-22785 Course Booking System = 5.0.12 AND time-based blind query SLEEP Payload: action=cbsa...
Offensive
Curso de tecnologías ofensivas Este repositorio contiene descripciones de varias vulnerabilidades y el código que las explota. Los entornos explotables se encuentran en la carpeta /dockerfiles/victim. Los entornos del atacante se encuentran en la carpeta /dockerfiles/attacker. Todo viene como...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
EUVD-2026-90544
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
PT-2026-103719
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...
CVE-2026-102585 Moodle: group validation missing when enrolling user to course
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...
CVE-2026-102585
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...
CVE-2026-96886
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
WordPress Course Booking System plugin 7.0-7.0.8 - Unauthenticated Attendee PII Disclosure vulnerability
Unauthenticated Attendee PII Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Course Booking System versions 7.0-7.0.8...
CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
CVE-2026-96886
The Course Booking System WordPress plugin, in versions prior to 7.0.9 , contains a vulnerability where it fails to restrict access to its booking export function. This allows unauthenticated users to download sensitive personally identifiable information (PII), including the name, email address,...
EUVD-2026-89626
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
PT-2026-103047
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
CVE-2026-96886: Exposure of Sensitive Information to an Unauthorized Actor
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...