Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ThemeumTutor Lms

27 matches found

CVE
CVE•added 2024/11/21 11:15 a.m.•88 views

CVE-2024-10400

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauth...

7.5CVSS7.6AI score0.9293EPSS
CVE
CVE•added 2024/02/29 1:43 a.m.•68 views

CVE-2024-1133

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers,...

4.3CVSS5.2AI score0.00207EPSS
CVE
CVE•added 2024/05/16 10:15 a.m.•58 views

CVE-2024-4352

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'get_calendar_materials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function due to insuffi...

8.8CVSS7AI score0.13807EPSS
CVE
CVE•added 2024/05/16 10:15 a.m.•56 views

CVE-2024-4351

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-l...

8.8CVSS6.6AI score0.22384EPSS
CVE
CVE•added 2024/06/11 10:15 a.m.•54 views

CVE-2023-25799

Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.

8.8CVSS8.7AI score0.00442EPSS
CVE
CVE•added 2024/05/16 10:15 a.m.•52 views

CVE-2024-4222

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete...

8.2CVSS6.6AI score0.0044EPSS
CVE
CVE•added 2024/02/29 1:43 a.m.•49 views

CVE-2024-1128

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student ac...

5.4CVSS6AI score0.0015EPSS
CVE
CVE•added 2024/05/16 9:15 a.m.•47 views

CVE-2024-4223

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete dat...

9.8CVSS6.6AI score0.01269EPSS
CVE
CVE•added 2024/11/21 11:15 a.m.•45 views

CVE-2024-10393

The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the ...

5.3CVSS5.2AI score0.00074EPSS
CVE
CVE•added 2024/03/21 2:51 a.m.•45 views

CVE-2024-1503

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated atta...

4.3CVSS8.9AI score0.00145EPSS
CVE
CVE•added 2024/04/25 10:15 a.m.•45 views

CVE-2024-3994

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attribute...

5.4CVSS5.7AI score0.002EPSS
CVE
CVE•added 2024/07/09 10:15 a.m.•44 views

CVE-2024-37266

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.

7.2CVSS6AI score0.00556EPSS
CVE
CVE•added 2024/05/16 6:15 a.m.•43 views

CVE-2024-4279

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow ...

6.5CVSS6.5AI score0.00214EPSS
CVE
CVE•added 2024/06/07 5:15 a.m.•42 views

CVE-2024-4902

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

7.2CVSS7.2AI score0.00871EPSS
CVE
CVE•added 2024/07/09 9:15 a.m.•41 views

CVE-2024-37256

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.

7.6CVSS7.5AI score0.00117EPSS
CVE
CVE•added 2024/08/18 10:15 p.m.•40 views

CVE-2024-43282

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.

7.6CVSS7.9AI score0.00336EPSS
CVE
CVE•added 2024/05/16 6:15 a.m.•39 views

CVE-2024-4318

The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for a...

8.8CVSS7.1AI score0.00475EPSS
CVE
CVE•added 2024/08/12 9:15 p.m.•38 views

CVE-2024-43231

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.

6.5CVSS6.4AI score0.0007EPSS
CVE
CVE•added 2024/05/02 5:15 p.m.•37 views

CVE-2024-3553

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable use...

6.5CVSS6.6AI score0.00219EPSS
CVE
CVE•added 2024/07/20 9:15 a.m.•37 views

CVE-2024-37947

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2.

5.9CVSS5.8AI score0.0012EPSS
CVE
CVE•added 2024/08/30 4:15 a.m.•37 views

CVE-2024-5784

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenti...

7.1CVSS6.4AI score0.00355EPSS
CVE
CVE•added 2024/09/10 10:15 a.m.•36 views

CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...

4.3CVSS4.6AI score0.00043EPSS
CVE
CVE•added 2024/03/21 2:51 a.m.•35 views

CVE-2024-1502

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with su...

5.4CVSS8.9AI score0.00076EPSS
CVE
CVE•added 2024/08/26 9:15 p.m.•35 views

CVE-2024-39645

Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.

8.8CVSS7AI score0.00056EPSS
CVE
CVE•added 2024/06/07 1:15 p.m.•33 views

CVE-2024-5438

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated atta...

4.3CVSS4.8AI score0.00143EPSS
CVE
CVE•added 2024/11/01 3:15 p.m.•32 views

CVE-2024-43142

Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.

8.8CVSS4.6AI score0.00137EPSS
CVE
CVE•added 2024/03/13 4:15 p.m.•28 views

CVE-2024-1751

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

8.8CVSS9AI score0.00506EPSS