CVE-2026-89333

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89333 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89333

Tutor LMS (eLearning plugin for WordPress, versions up to and including 4.0.8 ) contains an Insecure Direct Object Reference (IDOR) vulnerability via the student_id parameter, caused by missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can...

EUVD-2026-83467

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89333 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89333: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

WordPress Tutor LMS plugin <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Information Exposure via 'studentid' Parameter vulnerability discovered by Dthangws - PTIT in WordPress Plugin Tutor LMS versions = 4.0.8...

CVE-2026-86267

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-86267

itsourcecode Information System Society Membership System 1.0 is vulnerable to SQL injection through the student_id argument in /society/check_student.php . The vulnerability allows remote exploitation with low privileges required and no user interaction. CVSS 3.1 rates it 6.3 (MEDIUM) with low i...

EUVD-2026-72243

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-86267 itsourcecode Information System Society Membership System check_student.php sql injection

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-86267 itsourcecode Information System Society Membership System check_student.php sql injection

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-86267: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-76999

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76999 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

EUVD-2026-63401

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76999 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76999

SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 is affected by an improper authorization vulnerability in the add_grade function of /index.php. Manipulating the student_id argument allows a remote, low-privilege attacker to bypass authorization controls, resulting in ...

CVE-2026-76999: Improper Authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-10226 raisulislamg4 student_management_system_by_php delete.php sql injection

A flaw has been found in raisulislamg4 studentmanagementsystembyphp up to 310d950e09013d5133c6b9210aff9444382d16d1. Impacted is an unknown function of the file delete.php. Executing a manipulation of the argument userid/courseid/teacherid/studentid/applicationid can lead to sql injection. The...