79 matches found
MoodleExploit
Moodle エクスプロイト Exploit Title: Moodle v3.4.1 RCE エクスプロイト Google Dork: inurl:"/course/jumpto.php?jump=" 日付: 2019年3月15日 作成者: Darryn Ten Vendor Homepage: https://moodle.org Software Link: https://github.com/moodle/moodle/archive/v3.4.1.zip バージョン: 3.4.1 おそらく 3.5.0 さらには 3.x も対象 テスト環境: Linux Moodle v3.4...
CVE-2020-14321
CVE-2020-14321 コース登録により、教師ロールからマネージャーロールへの権限昇格が可能になり、RCE に至る 誰かが Python スクリプトを必要とするかもしれないので、それを悪用するスクリプトを作成しました。 この PoC の使用方法: How to use this PoC script Case 1. If you have vaid credentials: python3 cve202014321.py -u http://test.local:8080 -u teacher -p 1234 -cmd=dir Case 2. If you have valid...
CVE-2025-25615
CVE-2025-25615 Unifiedtransform v2.0 存在不正确的访问控制漏洞，允许教师查看所有班级的考勤列表。 厂商：Unifiedtransform PoC 步骤1： 以教师身份登录应用程序。 步骤2： 访问以下端点： /attendances/view?classid=1§ionid=2&courseid=1 （修改 classid 和 sectionid 参数以访问不同的班级。） 步骤3： 查看任意班级的考勤情况。 影响： 这允许未经授权访问所有班级的考勤数据，而该功能本应仅限于管理员使用。这可能导致隐私泄露和数据滥用。 漏洞类型： 不正确的访问控制...
MOODLE-3.X-Remote-Code-Execution
MOODLE-3.X-Remote-Code-Execution cve-2018-1133 moodle において、教師として認証されたユーザーによるリモートコード実行。...
CVE-2026-75458
The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...
EUVD-2026-68881
The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...
GHSA-H9QX-V5XP-PH8P EGroupware has a Remote Code Execution Vulnerability
Summary A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution RCE. The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior...
CVE-2026-11988
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validation on a user controlled key. This makes it possible for...
EUVD-2026-40906
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validation on a user controlled key. This makes it possible for...
Reasoning As an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs
Large Reasoning Models LRMs have demonstrated remarkable capabilities in reasoning and generation tasks and are increasingly deployed in real-world applications. However, their explicit chain-of-thought CoT mechanism introduces new security risks, making them particularly vulnerable to jailbreak...
CVE-2026-32892
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move function in fileManage.lib.php passes user-controlled path values directly into exec shell commands without using...
CVE-2026-30875
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution RCE. The H5P package validation only checks if h5p.json exists but doesn't block...
CVE-2026-30884
CVE-2026-30884 affects the Moodle plugin mdjnelson/moodle-mod_customcert . Prior to versions 4.4.9 and 5.0.3, a teacher with the mod/customcert:manage capability in any single course can read and silently overwrite certificate elements for other courses. The vulnerability arises because the core_...
CVE-2026-30875
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution RCE. The H5P package validation only checks if h5p.json exists but doesn't block...
CVE-2026-30875
Chamilo LMS (prior to v1.11.36) exposes an authenticated RCE via H5P Import. An attacker with Teacher role can upload a crafted H5P package that bypasses validation (H5P package validation only checks for h5p.json and does not block .htaccess or PHP files with alternate extensions), enabling exec...
EUVD-2025-208167
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30...
CVE-2025-52482
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30...
CVE-2025-52482 Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30...
Chamilo 跨站脚本漏洞
Chamilo is an open-source learning management system developed by Chamilo. Versions of Chamilo prior to 1.11.30 had a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting flaw in the vocabulary function, which could allow users with teacher role...
CVE-2025-60507
Cross site scripting vulnerability in Moodle GeniAI plugin localgeniai 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users including Students or...