Design/Logic Flaw

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...

CVE-2021-36539

CVE-2021-36539 affects Instructure Canvas LMS. The issue is improper access control where unprivileged users can access locked/unpublished files via the DocViewer-based file preview URL (canvadoc_session_url). Root cause: inadequate denial of access for document previews. Impact: information disc...

CVE-2021-36539

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...

Instruction Canvas LMS 信息泄露漏洞

Canvas LMS is an open source learning management system from Instructure Open Source. Instruction Canvas LMS has a security vulnerability that stems from not properly denying access to locked or unreleased files...

CVE-2022-45820 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection

SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...

CVE-2022-45820 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection

SQL Injection SQLi vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions...

CVE-2022-45820

CVE-2022-45820 is a SQL Injection vulnerability in LearnPress – WordPress LMS Plugin versions

CVE-2022-45808

LearnPress WordPress LMS plugin

CVE-2022-47615

CVE-2022-47615 – LearnPress WordPress plugin Affected software: LearnPress – WordPress LMS Plugin, versions

Academy LMS 5.11 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

WordPress Tutor LMS Plugin < 2.0.10 is vulnerable to Cross Site Scripting (XSS)

Software Tutor LMS Type Plugin Vulnerable versions 2.0.10 Fixed in 2.0.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0236 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 18dcd075ba54 Credits So Sakaguchi Required...

Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the resetkey and userid parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC...

Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the resetkey and userid parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

VulnCheck KEV: CVE-2021-24184

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

BDWeb-Link LMS 1.11.5 Insecure Direct Object Reference

==================================================================================================================================== | Title : BDWeb-Link Lms v1.11.5 Unauthorized administrative access Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozil...

Maximizing Roi With The Best LMS For Elearning

By Owais Sultan The world of eLearning has seen tremendous growth in recent years, with more and more organizations turning to… This is a post from HackRead.com Read the original post: Maximizing Roi With The Best LMS For Elearning...

BDWeb-Link LMS 1.11.5 SQL Injection

==================================================================================================================================== | Title : BDWeb-Link Lms v1.11.5 SQL Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 108.032-bi...

Forma LMS <= 2.4.4 Improper Authentication Vulnerability

Forma LMS is prone to an improper authentication vulnerability. Copyright C 2022 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...

Forma SPOT-LMS 3.2.1 Cross Site Scripting

Title: Forma SPOT-LMS-3.2.1 Cross-site scripting reflected RCE - reset mail vulnerability Author: nu11secur1ty Date: 11.07.2022 Vendor: https://www.spotlms.us/indexmulti.php The software is applied in the demo account: https://www.spotlms-anca-001.ovh/ Reference:...

Forma LMS <= 3.1.0 Multiple Vulnerabilities

Forma LMS is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation...