37495 matches found
CVE-2026-114389
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
CVE-2026-114390
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
CVE-2026-114387
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...
CVE-2026-111849
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5...
CVE-2026-114120
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the realpathSync function in the fs module. An attacker can probe whether paths outside the permitted fs.read set exist by supplying them to fs.realpathSync, whose lstat walk reveals whether a path is missing...
EUVD-2026-107214
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5...
CVE-2026-114390 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
CVE-2026-114390 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
CVE-2026-114390
Chamilo LMS versions 2.0.0-alpha.1 before 2.0.0-RC.3 are vulnerable to a missing authorization flaw in legacy AJAX handlers located under public/main/inc/ajax/. This vulnerability allows unauthenticated or low-privileged users to invoke specific actions, such as get_users_by_group_course, user_by...
CVE-2026-114390 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
EUVD-2026-107237
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
CVE-2026-114390
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and...
CVE-2026-114389
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
CVE-2026-114389 Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
EUVD-2026-107236
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
CVE-2026-114389 Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
CVE-2026-114389 Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrad...
CVE-2026-114389
The Chamilo LMS software (versions 2.0.0-alpha.4 before 2.0.0-RC.3 ) is vulnerable to a missing authorization flaw in the AiController::openAnswerGrade function. This vulnerability allows any authenticated user to access the AI grading of other students' exam attempts by enumerating exeId and que...
EUVD-2026-107234
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...