3944 matches found
Namaste! LMS < 2.5.9.4 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to Namaste Settings, and at Payment...
Namaste! LMS < 2.5.9.2 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress Namaste! LMS Plugin <= 2.5.9.1 is vulnerable to Cross Site Scripting (XSS)
Software Namaste! LMS Type Plugin Vulnerable versions = 2.5.9.1 Fixed in 2.5.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24383 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a09354550881 Credits yuyudhn Required...
CVE-2022-47615
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
Remote file inclusion
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45820
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45808
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45808
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
Sql injection
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
Sql injection
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2021-36539
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...
CVE-2021-36539
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...
Design/Logic Flaw
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...
CVE-2021-36539
CVE-2021-36539 affects Instructure Canvas LMS. The issue is improper access control where unprivileged users can access locked/unpublished files via the DocViewer-based file preview URL (canvadoc_session_url). Root cause: inadequate denial of access for document previews. Impact: information disc...
CVE-2021-36539
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...
Instruction Canvas LMS 信息泄露漏洞
Canvas LMS is an open source learning management system from Instructure Open Source. Instruction Canvas LMS has a security vulnerability that stems from not properly denying access to locked or unreleased files...
CVE-2022-45820 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...
CVE-2022-45820 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...