3978 matches found
CVE-2024-6088
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user...
CVE-2024-6088
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user...
CVE-2024-6099 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'checkvalidatefields' function in the checkout. This makes it possible for unauthenticated...
CVE-2024-6099
CVE-2024-6099 affects the LearnPress – WordPress LMS Plugin. The vulnerability is an unauthenticated registration bypass caused by missing authorization checks in the checkout flow (check_validate_fields), enabling an attacker to register with the site’s default role even if registration is disab...
CVE-2024-6088
CVE-2024-6088 concerns the LearnPress – WordPress LMS Plugin. Affected: all versions up to and including 4.2.6.8.1. Root cause: missing capability check in the register function, enabling unauthenticated users to bypass disabled registration and create accounts with the default role. Impact: unau...
CVE-2024-6088 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user...
CVE-2024-6088 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user...
PT-2024-37378 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.8.1 Description: The issue allows unauthorized user registration due to a missing capability check on the register function. This enables unauthenticated attackers to bypa...
WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability
Path Traversal vulnerability discovered by filime Patchstack Alliance in WordPress Plugin Tutor LMS versions = 2.7.1...
WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by justakazh Patchstack Alliance in WordPress Plugin Tutor LMS versions = 2.7.1...
WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to SQL Injection
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37256 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID c87880efca91 Credits justakazh Required privilege Administrator Published 27...
WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to Local File Inclusion
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-37266 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 8224e271a86b Credits filime Required privilege Administrator Publishe...
WordPress Academy LMS Plugin <= 2.0.10 is vulnerable to Open Redirection
Software Academy LMS Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-37234 Patch priority Low CVSS severity Low 3.5 Developer Claim ownership PSID 657d1fa47413 Credits Mochamad Sofyan Required privilege Subscriber...
WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin MasterStudy LMS versions = 3.2.12...
WordPress MasterStudy LMS Plugin <= 3.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-37093 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID baf1167c8e0f Credits Majed Refaea...
WordPress MasterStudy LMS Plugin <= 3.2.12 is vulnerable to Broken Access Control
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.2.12 Fixed in 3.2.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37094 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID c81a1b1721c6 Credits Majed Refaea Required...
CVE-2024-37840
Affected software : Itsourcecode Learning Management System Project In PHP With Source Code v1.0. Vulnerability : SQL injection in processscore.php via the LessonID parameter. Root cause/impact : Allows remote attackers to execute arbitrary SQL commands; CVSS v3.1 score 8.8 (HIGH) with network ac...
CVE-2024-37840
SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to execute arbitrary SQL commands via the LessonID parameter...
Sensei LMS <= 4.23.1 & Sensei Pro (WC Paid Courses) <= 4.24.0.1.24.0 - Missing Authorization
Description The Sensei LMS and Sensei Pro WC Paid Courses plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flushrewriterules function in versions up to, and including, 4.23.1 and . 4.24.0.1.24.0 respectively. This makes it possible...