CVE-2026-78054

SourceCodester Class and Exam Timetabling System 1.0 contains a Cross-Site Scripting (XSS) vulnerability in the file /BSIS1.php . The flaw is triggered by manipulating the course parameter, allowing a remote, unauthenticated attacker to inject malicious scripts into the application. User interact...

CVE-2026-14187

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

CVE-2026-14187

Tutor LMS WordPress plugin versions prior to 4.0.6 are affected by an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to enforce per-object ownership checks on its course content type, allowing any authenticated user with the instructor role to read the content of private ...

CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

CVE-2026-64963

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

CVE-2026-64963

ATutor's path traversal flaw is exploitable only when the AT_FORCE_GET_FILE config option is enabled, allowing authenticated users to read files from other course directories. The product is no longer actively supported; version 2.2.4 was confirmed vulnerable with no fix available, so mitigation ...

CVE-2026-64963 Path Traversal in ATutor

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

EUVD-2026-63363

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

EUVD-2026-60555

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75078

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75078

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75078

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to reflected/stored XSS via the "course" argument in /BSHRM1.php, which is echoed without sanitization. CVSS 4.3 (Medium) reflects low integrity impact requiring user interaction. No patch version is specified in any source; the e...

CVE-2026-75078 SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75077

SourceCodester Class and Exam Timetabling System 1.0 has a reflected cross-site scripting (XSS) flaw in BSCE2.php, where the "course" argument is rendered without sanitization, allowing unauthenticated remote attackers to inject scripts; CVSS 4.3 (Medium) scores it as network-accessible with low ...

CVE-2026-75077 SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

EUVD-2026-57072

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-14306

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...