CVE-2023-49339

CVE-2023-49339 보안 취약점 보고서: Ellucian Banner 시스템 소개 이 문서는 Ellucian Banner 시스템, 특히 버전 9.17 및 이전 버전에서 발견된 심각한 보안 취약점에 대해 설명합니다. 이 취약점은 사우디아라비아의 여러 대학에서 사용되는 시스템에서 확인되었으며, 민감한 학생 데이터가 노출될 가능성이 있습니다. 취약점 세부 정보 유형: 안전하지 않은 직접 객체 참조IDOR 영향을 받는 엔드포인트: /StudentSelfService/ssb/studentCard/retrieveData 문제의...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-88844: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

EUVD-2026-80202

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86447

The LearnPress WordPress plugin (versions before 4.4.7 ) is vulnerable to an unauthenticated student enrollment disclosure. The root cause is a failure to check user capabilities within an administrative course tool, specifically the load_content_via_ajax handler. An unauthenticated attacker can ...

PT-2026-93303

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86447: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-71241 Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-57912

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

CVE-2026-57912

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

EUVD-2026-39643

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

CVE-2026-57912

This CVE concerns the Johnson & Johnson Campus Recruiting web application (pre-2025-10-31), where data provided by recruited students and notes entered by interviewers may be viewed by unauthorized parties. The vulnerability implies an exposure of personal/student data with no available details o...

CVE-2026-57912

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

CVE-2026-57912

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

PT-2026-52692

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers...

CVE-2026-11333

A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. The impacted element is an unknown function of the file dashboardpage/forms/uploadstudentdata.php of the component Student Data...

CVE-2026-11333

A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. The impacted element is an unknown function of the file dashboardpage/forms/uploadstudentdata.php of the component Student Data...

CVE-2026-11333 tittuvarghese CollegeManagementSystem Student Data Upload Endpoint upload_student_data.php unrestricted upload

A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. The impacted element is an unknown function of the file dashboardpage/forms/uploadstudentdata.php of the component Student Data...

CVE-2026-11333 tittuvarghese CollegeManagementSystem Student Data Upload Endpoint upload_student_data.php unrestricted upload

A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. The impacted element is an unknown function of the file dashboardpage/forms/uploadstudentdata.php of the component Student Data...