7 matches found
PT-2026-61837
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as complet...
PT-2026-47069
Name of the Vulnerable Software and Affected Versions Frontend User Notes versions prior to 2.1.2 Description The plugin is subject to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a logged-in user into executing unwanted actions. This occurs due to missing or incorrect nonce...
CVE-2024-55231
An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belonging to other accounts due to missing authorization checks. This flaw exposes sensitive data and enables attackers to alter another user's...
PT-2024-36497
Name of the Vulnerable Software and Affected Versions PHPGurukul Online Notes Sharing Management System version 1.0 Description An IDOR vulnerability in the edit-notes.php module allows unauthorized users to modify notes belonging to other accounts due to missing authorization checks. This flaw...
Server side request forgery (ssrf)
QPR Portal before 2012.2.1 allows remote attackers to modify or delete notes via a direct request...
PT-2015-4031
Name of the Vulnerable Software and Affected Versions QPR Portal versions prior to 2012.2.1 Description The issue allows remote attackers to modify or delete notes by making a direct request. Recommendations For versions prior to 2012.2.1, update to version 2012.2.1 or later to resolve the issue...
