CVE-2026-62132

CVE-2026-62132 is a Broken Access Control vulnerability affecting the Masteriyo – LMS WordPress plugin in versions ≤ 3.4.0 . The flaw allows users with the Subscriber role to bypass access controls, resulting in a low integrity impact (CVSS 3.1 score: 5.3 MEDIUM ). The vulnerability was discovere...

EUVD-2026-76205

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

EUVD-2026-76212

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

EUVD-2026-76159

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-82535 Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-82535 Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-82535

Chamilo LMS versions before 1.11.42 and 3.0.0 contain a stored cross-site scripting (XSS) vulnerability in the survey answer submission flow. Unauthenticated attackers can inject malicious script payloads into survey answers by computing deterministic invitation codes that bypass authorization ch...

learning-management-system

learning-management-system Masteriyo - LMS para WordPress = 1.6.7 - Exposición de Información Sensible Información del Plugin root@kitploit: Tipo de Software Plugin Slug del Software learning-management-system ver en wordpress.org ¿Parcheado? Sí Remediación Actualizar a la versión 1.6.8, o a una...

CVE-2026-22241

🚨 CVE-2026-22241 - Ejecución remota de código en la importación de temas de Open eClass 📌 Resumen de la vulnerabilidad Open eClass también conocido como GUnet eClass, un sistema de gestión de aprendizaje LMS de código abierto ampliamente utilizado, contiene una vulnerabilidad crítica de carga de...

PT-2026-90003

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - Broken Access Control vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

CVE-2023-4220-PoC

CVE-2023-4220 Subida Arbitraria de Archivos / RCE - PoC Creé este script para automatizar la explotación de CVE-2023-4220 y obtener una reverse shell en la máquina PermX de Hack The Box. Esta vulnerabilidad afecta a Chamilo LMS versiones ≤ 1.11.24 , debido a una validación insuficiente en la...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - Missing Authorization to Authenticated Student+ Privilege Escalation to Administrator 🔴 Vulnerability Overview CVE-2026-4484 — Authenticated Privilege Escalation Student → Administrator Description: The Masteriyo LMS plugin for WordPress is vulnerable to...

CVE-2026-1375

CVE-2026-1375: IDOR autenticado / Control de acceso roto en el plugin Tutor LMS Aviso: Este repositorio se crea solo con fines educativos y divulgación ética. La vulnerabilidad ha sido reportada de manera responsable al proveedor y ya ha sido parcheada. No utilice esta información para explotar...

CVE-2025-65676

CVE-2025-65676 Classroomio LMS 0.1.13 中存在存储型跨站脚本（XSS）漏洞，允许经过身份验证的攻击者通过精心构造的 SVG 封面图片执行任意代码。发现者：Rivek Raj Tamang RivuDon，印度锡金邦。 受影响产品：ClassroomIO 受影响版本：0.1.13 发现者：Rivek Raj Tamang RivuDon，印度锡金邦 漏洞详情 存储型跨站脚本 摘要 在 Classroomio LMS 0.1.13 版本中存在一个存储型跨站脚本（XSS）漏洞，应用程序未能对课程封面图片上传进行消毒。经过身份验证的攻击者可以上传包含嵌入式...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - 缺失授权导致未经验证的有限选项更新 Tutor LMS – 适用于WordPress的在线学习和在线课程解决方案插件，在其所有版本（包括2.6.2及之前版本）中，由于hidenotices函数缺少权限检查，导致数据可被未经授权修改。这使得经过身份验证的攻击者（包括订阅者等低权限用户）能够在管理员可能已禁用的站点上启用用户注册。 详情 类型 : 插件 别名 : tutor 受影响版本 : 2.6.2 CVSS评分 : 6.5 CVSS等级 : 中等 CVSS向量 :...

CVE-2025-69581

CVE-2025-69581 Chamillo LMS 1.11.2 中发现了一个问题。Social Network /personaldata 端点在注销后仍然暴露完整的敏感用户信息，因为缺少适当的缓存控制。使用浏览器后退按钮会恢复所有个人数据，允许同一设备上的未经授权用户查看机密信息。这导致用户画像分析、身份冒充、定向攻击以及严重的隐私风险。发现者：Rivek Raj Tamang RivuDon，印度锡金。 受影响产品：Chamilo LMS 受影响版本：1.11.2 发现者：Rivek Raj Tamang RivuDon，印度锡金 漏洞详情 信息泄露 摘要 该漏洞允许未经授权访...