CVE-2021-24181

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

Information disclosure

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

Sql injection

The tutorplacerating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

Sql injection

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24182 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutorquizbuildergetanswersbyquestion AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24183 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form

The tutorquizbuildergetquestionform AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24185 Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutorplacerating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24186 Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24184

The Tutor LMS – eLearning and online course solution WordPress plugin is vulnerable in versions before 1.7.7 due to unprotected AJAX endpoints . This security flaw allows students to perform unauthorized actions, including modifying course information and achieving privilege escalation . Exploita...

CVE-2021-24184 Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

CVE-2021-24181 Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24186

The Tutor LMS – eLearning and online course solution WordPress plugin, in versions before 1.8.3 , is vulnerable to a UNION based SQL injection . The flaw exists within the tutor_answering_quiz_question/get_answer_by_id function pair. This vulnerability arises from a lack of validation of external...

CVE-2021-24181

The CVE covers Tutor LMS (WordPress plugin) prior to version 1.7.7, where the tutor_mark_answer_as_correct AJAX action is vulnerable to blind and time-based SQL injections. This could enable an attacker (e.g., students) to manipulate queries via that action. Affected component: Tutor LMS WordPres...

CVE-2021-24185

The CVE-2021-24185 affects the Tutor LMS WordPress plugin prior to version 1.7.7. The vulnerability lies in the tutor_place_rating AJAX action, where blind and time-based SQL injections allow exploitation by a student attacker. Impact, as stated, is exposure of data through SQL injection; exploit...

CVE-2021-24182

The Tutor LMS – eLearning and online course solution WordPress plugin, in versions prior to 1.8.3 , is vulnerable to a UNION based SQL injection within the tutor_quiz_builder_get_answers_by_question AJAX action. This vulnerability stems from a lack of validation of externally entered SQL statemen...

PT-2021-15727

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.7.7 Description: The issue concerns a SQL injection vulnerability in the tutor mark answer as correct AJAX action. This could potentially be exploited by...

Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The plugin is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file PoC https://your.domain/wp-admin/admin.php?page=tutor-tools⊂page=..%2F..%2F..%2F..%2F..%2F..%2Fin...

CVE-2021-24183: Improper Neutralization of Special Elements used in an SQL Command

The tutorquizbuildergetquestionform AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

PT-2021-15732

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.8.3 Description: The issue concerns a UNION based SQL injection vulnerability in the tutor answering quiz question/get answer by id function pair. This coul...

WordPress Tutor LMS plugin <= 1.8.7 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by sasa in WordPress Tutor LMS plugin versions = 1.8.7 Solution Update the WordPress Tutor LMS plugin to the latest available version at least 1.8.8...