Lucene search
+L

4024 matches found

Kitploit
Kitploit
added 2026/09/14 12:27 p.m.4 views

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

9.8CVSS8.1AI score0.85334EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/14 7:58 a.m.9 views

CVE-2023-4220-Chamilo-LMS

Chamilo LMS Unauthenticated Big Upload File RCE PoC This script allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependencies using pip...

8.1CVSS7.1AI score0.76084EPSS
SaveExploits27
Kitploit
Kitploit
added 2026/09/14 6:47 a.m.11 views

CVE-2023-4226

🛠️ Exploitation CVE-2023-4226 for Chamilo LMS 📋 Description Python script that automates the exploitation of CVE-2023-4226 , an unrestricted file upload vulnerability in Chamilo LMS = v1.11.24. Uploads a PHP web shell based on PentesterMonkey and configures .htaccess to achieve a reverse shell...

8.8CVSS7.9AI score0.02433EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/14 6:30 a.m.3 views

Chamilo-CVE-2023-4220-Exploit

Chamilo-LMS-CVE-2023-4220-Exploit This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24, and Attackers can obtain remote code execution via uploading of web...

8.1CVSS7.2AI score0.76084EPSS
SaveExploits27
Kitploit
Kitploit
added 2026/09/14 6:03 a.m.5 views

Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220

Chamilo-LMS-Unauthenticated-File-Upload- Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via...

8.1CVSS7.2AI score0.76084EPSS
SaveExploits27
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.50 views

Sensei LMS < 4.24.2 - Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. id: CVE-2024-7786 info: name: Sensei LMS 4.24.2 - Email Template Leak author: s4e-io severity: high description: | The Sensei LMS WordPress...

7.5CVSS5.7AI score0.01745EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.63 views

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

6.1CVSS6.3AI score0.01347EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.29 views

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...

6.1CVSS6.3AI score0.00747EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.45 views

WordPress Sensei LMS <4.5.0 - Information Disclosure

WordPress Sensei LMS plugin before 4.5.0 is susceptible to information disclosure. The plugin does not have proper permissions set in a REST endpoint, which can allow an attacker to access private messages. id: CVE-2022-2034 info: name: WordPress Sensei LMS 4.5.0 - Information Disclosure author:...

5.3CVSS5.9AI score0.02528EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.10 views

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

9.8CVSS5.9AI score0.01498EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.24 views

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

5.3CVSS5.9AI score0.00976EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.27 views

LearnPress < 4.2.7.4 - Course Material - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. id: CVE-2024-11868 info: name: LearnPress 4.2.7.4 -...

5.3CVSS7.9AI score0.01131EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.8 views

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. id: CVE-2026-81199 info:...

5.3CVSS0.00302EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/14 3:35 a.m.7 views

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' ⚠️ CVE-2025-14156 – Fox LMS WordPress Unauthenticated Privilege Escalation Exploit 🛡️ Vulnerability Overview Fox LMS – WordPress LMS Plugin v1.0.4.7 to v1.0.5.1 – Unauthenticated...

9.8CVSS6AI score0.06811EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/14 2:29 a.m.6 views

CVE-2023-4220-HTB-PermX

Chamilo-LMS-CVE-2023-4220-Exploit Description This exploit demonstrates an Unrestricted file upload vulnerability in Chamilo-LMS. The vulnerability affects the big file upload functionality located at: root@kitploit: /main/inc/lib/javascript/bigupload/inc/bigUpload.php Affected Versions : Chamilo...

8.1CVSS7.2AI score0.76084EPSS
SaveExploits27
Kitploit
Kitploit
added 2026/09/14 12:45 a.m.6 views

CVE-2023-45878_to_RCE

CVE-2023-45878 to RCE This script chains and automates Arbitrary File Write to RCE on Gibbon LMS through CVE-2023-45878 exploitation. The script performs the following steps: 1. Generates an msfvenom stageless reverse shell for Windows 2. Uploads a webshell exploiting CVE-2023-45878 3. Downloads...

9.8CVSS8.1AI score0.63113EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/13 11:23 p.m.5 views

CVE-2023-4220-Exploit

CVE-2023-4220-Exploit LMS Chamilo 1.11.24 CVE-2023-4220 Exploit Exploit usado para CVE-2023-4220 aprovecha el error de programacion del LMS Chamillo el cual nos permite subir un fichero al servidor sin ningun tipo de restriccion. Este Exploit fue escrito para nuestra maquinita Easy permX de HTB,...

8.1CVSS7.2AI score0.76084EPSS
SaveExploits27
Kitploit
Kitploit
added 2026/09/13 9:46 p.m.7 views

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

9.8CVSS8.1AI score0.85334EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/13 8:11 p.m.9 views

CVE-2026-48909

CVE-2026-48909 — Inyección de Objetos PHP en SP LMS → RCE Ejecución Remota de Código sin Autenticación mediante Inyección de Objetos PHP en JoomShaper SP LMS comsplms ≤ 4.1.3 para Joomla CMS. Autor: Amin İsayev / Proxima Cyber Security Resumen SP LMS es una extensión popular de Sistema de Gestión...

9.5CVSS6AI score0.04941EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/13 7:50 p.m.14 views

CVE-2022-28986

CVE-2022-28986 A Insecure direct object references IDOR vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Critical Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Insecure direct object...

7.5CVSS7.3AI score0.023EPSS
SaveExploits1
Rows per page
Query Builder