Tutor LMS < 2.6.1 - Student+ HTML Injection via Q&A

2024-02-2100:00:00

wpscan.com

tutor lms

html injection

q&a

authenticated attackers

student access

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The plugin is vulnerable to HTML Injection due to insufficient sanitization of HTML input in the Q&A; functionality, allowing authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting