CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37094 – WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-37094
Access Control vulnerability in StylemixThemes MasterStudy LMS allows . This issue affects MasterStudy LMS: from n/a through 3.2.12. The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_order and create_order functions in versions up to, and including, 3.2.12. This makes it possible for unauthenticated attackers to create and save orders. • https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-2-12-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37093 – MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2024-37093
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link. • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35686 – WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-35686
Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1. The Sensei LMS and Sensei Pro (WC Paid Courses) plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flush_rewrite_rules() function in versions up to, and including, 4.23.1 and . 4.24.0.1.24.0 respectively. This makes it possible for unauthenticated attackers to flush rewrite rules. • https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-23-1-broken-access-control-vulnerability?_s_id=cve https://patchstack.com/database/vulnerability/woothemes-sensei/wordpress-sensei-pro-wc-paid-courses-plugin-4-23-1-1-23-1-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29913 – WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29913
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en Themeum Tutor LMS Elementor Addons permite XSS almacenado. Este problema afecta a los complementos de Tutor LMS Elementor: desde n/a hasta 2.1.3. The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/tutor-lms-elementor-addons/wordpress-tutor-lms-elementor-addons-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-1000535
https://notcve.org/view.php?id=CVE-2018-1000535
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files on the server. This attack appear to be exploitable via GET parameter. This vulnerability appears to have been fixed in after commit 254765e. lms en versiones iguales o anteriores a la LMS_011123 contiene una vulnerabilidad de divulgación de archivos locales en la funcionalidad de lectura de archivos en el módulo LMS que puede resultar en la lectura de archivos en el servidor. Este ataque parece ser explotable mediante un parámetro GET. La vulnerabilidad parece haber sido solucionada tras el commit con ID 254765e. • https://0dd.zone/2018/06/01/LMS-Local-File-Disclosure https://github.com/lmsgit/lms/issues/1271 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •