RWST

RWST Red Widow Spider Tools Termux Apps AD...

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions such as blocking legitimate instructors. id: CVE-2020-8615 info: name: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Reque...

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

CVE-2026-89081

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-88944

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-89333

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-83477

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89081

The Tutor LMS WordPress plugin (eLearning and online course solution) is affected by Reflected Cross-Site Scripting (XSS) via the 'search' parameter in all versions up to and including 4.0.8 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can in...

CVE-2026-88944 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-88944

CVE-2026-88944 is an authorization bypass in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8 ). The plugin fails to properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access or above to permanently delete a...

EUVD-2026-83474

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-89333

Tutor LMS (eLearning plugin for WordPress, versions up to and including 4.0.8 ) contains an Insecure Direct Object Reference (IDOR) vulnerability via the student_id parameter, caused by missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can...

CVE-2026-89333 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

EUVD-2026-83467

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

Tutor LMS <= 2.7.6 - SQL Injection

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘ratingfilter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start root@kitploit: 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPres...