405 matches found
WordPress MasterStudy LMS Plugin <= 3.3.3 is vulnerable to Local File Inclusion
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3136 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0e613f9f337e Credits Hiroho Shimada Required privilege...
WordPress MasterStudy LMS plugin <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action vulnerability
Unauthenticated Privilege Escalation via stmlmsregister AJAX Action vulnerability discovered by Hiroho Shimada in WordPress Plugin MasterStudy LMS versions = 3.3.1...
WordPress MasterStudy LMS plugin <= 3.3.0 - Unauthenticated Local File Inclusion via modal vulnerability
Unauthenticated Local File Inclusion via modal vulnerability discovered by Hiroho Shimada in WordPress Plugin MasterStudy LMS versions = 3.3.0...
WordPress MasterStudy LMS Plugin <= 3.3.1 is vulnerable to Privilege Escalation
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-2409 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 8dbe36bee6fd Credits Hiroho...
WordPress MasterStudy LMS Plugin <= 3.3.0 is vulnerable to Local File Inclusion
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2411 Patch priority High CVSS severity High 9 Developer Claim ownership PSID c509d4c43d0b Credits Hiroho Shimada Required privilege...
CVE-2024-2411
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...
CVE-2024-2409
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the registeruser function called by the 'wpajaxnoprivstmlmsregister' AJAX action. This makes it possible for...
CVE-2024-2411
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...
CVE-2024-2409
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the registeruser function called by the 'wpajaxnoprivstmlmsregister' AJAX action. This makes it possible for...
CVE-2024-2411
CVE-2024-2411 affects MasterStudy LMS WordPress plugin (
CVE-2024-2409
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the registeruser function called by the 'wpajaxnoprivstmlmsregister' AJAX action. This makes it possible for...
CVE-2024-2409
MasterStudy LMS WordPress Plugin vulnerability overview (CVE-2024-2409): affects versions <= 3.3.1, enabling unauthenticated privilege escalation by abusing the _register_user() flow. The flaw requires MasterStudy LMS Pro with LMS Forms Editor add-on; it allows an attacker to supply arbitrary ...
PT-2024-20274 · WordPress · Masterstudy Lms
Name of the Vulnerable Software and Affected Versions: MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.0 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the modal parameter. This enables the execution of any...
WordPress Plugin MasterStudy LMS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
PT-2024-20262 · WordPress · Masterstudy Lms
Name of the Vulnerable Software and Affected Versions: MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.1 Description: The issue is due to insufficient validation checks within the register user function called by the 'wp ajax nopriv stm lms register' AJAX action. This allo...
MasterStudy LMS < 3.3.2 - Unauthenticated Privilege Escalation
Description The plugin is vulnerable to Privilege Escalation due to insufficient validation checks within the registeruser function called by the 'wpajaxnoprivstmlmsregister' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges...
WordPress Plugin MasterStudy LMS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress MasterStudy LMS Plugin <= 3.2.13 is vulnerable to Broken Access Control
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.2.13 Fixed in 3.3.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1904 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4939af1093ec Credits Krzysztof Zając Required...
CVE-2024-2106
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email...
CVE-2024-2106
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email...