VulnCheck KEV: CVE-2024-33939

The Masteriyo LMS Plugin for WordPress is vulnerable to an insecure direct object reference that could allow unauthenticated adversaries to view other users course progress. Versions up to and including 1.7.3 are vulnerable via the REST API...

WordPress User Registration Plugin <= 3.1.5 is vulnerable to Broken Access Control

Software User Registration Type Plugin Vulnerable versions = 3.1.5 Fixed in 3.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2417 Patch priority High CVSS severity High 8.8 Developer Masteriyo PSID f4d185ab446a Credits Stiofan Required privilege...

Masteriyo - LMS < 1.7.3 - Unauthenticated Privilege Escalation

Description The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateloggedinuser function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated...

WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Masteriyo - LMS versions = 1.7.2...

WordPress Masteriyo - LMS Plugin <= 1.7.2 is vulnerable to Privilege Escalation

Software Masteriyo - LMS Type Plugin Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-24882 Patch priority High CVSS severity High 9.8 Developer Masteriyo PSID fe3cf3933428 Credits Steven Julian Required privilege...

VulnCheck KEV: CVE-2024-24882

Improper Privilege Management vulnerability in Masteriyo LMS allows Privilege Escalation.This issue affects LMS: from n/a through 1.7.2...

WordPress User Registration Plugin <= 3.1.4 is vulnerable to Cross Site Scripting (XSS)

Software User Registration Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1720 Patch priority Low CVSS severity Low 7.1 Developer Masteriyo PSID f3574c07a0a6 Credits stealthcopter Required...

WordPress User Registration Plugin < 3.0.4.2 is vulnerable to Cross Site Scripting (XSS)

Software User Registration Type Plugin Vulnerable versions 3.0.4.2 Fixed in 3.0.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5228 Patch priority Low CVSS severity Low 5.9 Developer Masteriyo PSID b0a43efbedef Credits Mohamed Azarudheen Require...

CVE-2023-3345

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students...

Information disclosure

The LMS by Masteriyo WordPress plugin before 1.6.8 does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints...

CVE-2023-3345

CVE-2023-3345 affects the LMS by Masteriyo WordPress plugin prior to 1.6.8. The plugin’s REST API endpoints lack proper authorization, enabling any student to retrieve other students’ email addresses (information disclosure). Root cause per connected details: insufficient access checks on REST ro...

CVE-2023-3345 LMS by Masteriyo < 1.6.8 - Information Exposure

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students...

WordPress plugin LMS by Masteriyo 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

PT-2023-24346 · Masteriyo · The Lms By Masteriyo

Name of the Vulnerable Software and Affected Versions: The LMS by Masteriyo WordPress plugin versions prior to 1.6.8 Description: The issue concerns improper authorization in some of the plugin's REST API endpoints. This allows any students to retrieve email addresses of other students, effective...

LMS by Masteriyo < 1.6.8 - Information Exposure

The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. curl -i -s -k -X $'GET' \ -H $'Host: localhost:8000' -H $'sec-ch-ua: ' -H $'Accept: application/json...

WordPress Masteriyo - LMS Plugin < 1.6.8 is vulnerable to Sensitive Data Exposure

Software Masteriyo - LMS Type Plugin Vulnerable versions 1.6.8 Fixed in 1.6.8 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Masteriyo PSID aef3f4a1c0c4 Credits Unknown Required privilege Subscriber...

WordPress User Registration Plugin <= 3.0.2 is vulnerable to Arbitrary File Upload

Software User Registration Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.0.2.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-3342 Patch priority High CVSS severity High 9.9 Developer Masteriyo PSID 9e6954072452 Credits István Márton Required privilege Subscribe...