Lucene search
+L

1030 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.164 views

Tutor LMS <= 2.7.6 - SQL Injection

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘ratingfilter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

7.5CVSS7.3AI score0.8312EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.62 views

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

6.1CVSS6.5AI score0.01347EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.25 views

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

8.8CVSS7.4AI score0.03109EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.48 views

Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions such as blocking legitimate instructors. id: CVE-2020-8615 info: name: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Reque...

6.5CVSS6.6AI score0.0883EPSS
SaveExploits6References5
Kitploit
Kitploit
added 2026/08/31 3:39 a.m.6 views

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL注入实验环境 未认证的SQL注入漏洞存在于Tutor LMS WordPress插件(= 3.9.6)的couponcode参数中。 快速开始 root@kitploit: 1. 克隆并启动实验环境 git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh 部署WordPress + Tutor LMS 3.9.3 2. 运行利用脚本 pip install requests 唯一依赖 未认证(基于时间的盲注 ——...

7.5CVSS5.9AI score0.0048EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/30 6:36 p.m.4 views

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorización faltante para actualización limitada de opciones no autenticada El plugin Tutor LMS – eLearning and online course solution para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidades en la...

6.5CVSS6.6AI score0.00462EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/30 6:19 p.m.4 views

CVE-2025-65681

CVE-2025-65681 Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 中发现了一个问题,由于缺少适当的 cache-control HTTP 标头和客户端会话检查,本地未授权攻击者能够获取敏感信息。发现者 - Rivek Raj Tamang RivuDon,印度锡金。 受影响产品:Overhang.IO 受影响版本:20.0.2 发现者:Rivek Raj Tamang RivuDon,印度锡金 漏洞详情 信息泄露 摘要 该漏洞允许未授权访问 Overhang.IO Tutor tutor-open-edx 20.0.2...

3.3CVSS5.9AI score0.00215EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/28 3:53 p.m.4 views

CVE-2026-1375

CVE-2026-1375: Tutor LMS प्लगइन में प्रमाणित IDOR / टूटा एक्सेस नियंत्रण अस्वीकरण: यह रिपॉजिटरी केवल शैक्षिक उद्देश्यों और नैतिक प्रकटीकरण के लिए बनाई गई है। यह भेद्यता विक्रेता को जिम्मेदारीपूर्वक सूचित कर दी गई है और इसे पैच कर दिया गया है। उचित प्राधिकरण के बिना सिस्टम का शोषण करने के लिए इस...

8.1CVSS5.8AI score0.00345EPSS
SaveExploits1
Patchstack
Patchstack
added 2026/08/28 7:24 a.m.4 views

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

6.5CVSS6AI score0.00431EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/28 5:16 a.m.6 views

CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

6.5CVSS0.00431EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/28 3:39 a.m.38 views

CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

6.5CVSS0.00431EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/28 3:39 a.m.16 views

CVE-2026-16759

Tutor LMS (eLearning plugin for WordPress, versions ≤ 4.0.5 ) is vulnerable to unauthenticated Remote Code Execution limited to zero-argument function invocation via the tutor_course_filter_ajax AJAX action. The root cause is a missing authorization check combined with unsanitized array keys pass...

6.5CVSS6.2AI score0.00431EPSS
SaveIn wildExploits0References9
EUVD
EUVD
added 2026/08/28 3:39 a.m.6 views

EUVD-2026-67406

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

6.5CVSS6.2AI score0.00431EPSS
SaveExploits0References9
VulnCheck KEV
VulnCheck KEV
added 2026/08/28 12:00 a.m.12 views

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

6.5CVSS6AI score0.00431EPSS
SaveIn wildExploits0References2
NVD
NVD
added 2026/08/27 8:17 p.m.6 views

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

9.8CVSS0.00352EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 5:05 p.m.28 views

CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

9.8CVSS0.00352EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 5:05 p.m.24 views

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 is vulnerable to template variable shadowing : request data can overwrite internal variables during template rendering, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. This yields a CVSS 3.1 score...

9.8CVSS5.6AI score0.00352EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/27 7:16 a.m.5 views

CVE-2024-10400

CVE-2024-10400 Il plugin Tutor LMS per WordPress è vulnerabile a SQL Injection tramite il parametro 'ratingfilter' in tutte le versioni fino alla 2.7.6 inclusa versioni Nota : Lo sfruttamento utilizza un controllo di SQL injection cieca basata sul tempo con una soglia di ritardo di 5 secondi. Se ...

7.5CVSS9.2AI score0.8312EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/27 12:33 a.m.3 views

RWST

RWST Strumenti Ragno Vedova Rossa App Termux AD...

5.3AI score
SaveExploits0
Patchstack
Patchstack
added 2026/08/26 7:53 a.m.5 views

WordPress Tutor LMS plugin 4.0.0-4.0.6 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Tutor LMS versions 4.0.6...

5.3CVSS5.2AI score0.00283EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder