Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 103

Export CSV
CVE-2023-4805

Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting

The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-43142

WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2023-0236

Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting

The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-37947

WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-43231

WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-43282

WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2023-3133

Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-37266

WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-37256

WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2023-25799

WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities

Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-25017

Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24873

Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24740

Tutor LMS < 1.9.9 - Multiple Admin+ Stored Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24455

Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24242

Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24186

Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id

The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24185

Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24184

Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24183

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form

The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24182

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms