CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25200
https://notcve.org/view.php?id=CVE-2021-25200
Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\student_avatar.php. Una vulnerabilidad de carga de archivos arbitrarios en SourceCodester Learning Management System versión v1.0, permite a atacantes ejecutar código arbitrario, por medio de la carga de archivos en el archivo \lms\student_avatar.php • https://github.com/TCSWT/Learning-Management-System/blob/main/README.md • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25201
https://notcve.org/view.php?id=CVE-2021-25201
SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information. Una vulnerabilidad de inyección SQL en Learning Management System versión v1.0, permite a atacantes remotos ejecutar sentencias SQL arbitrarias mediante el parámetro id para obtener información confidencial de la base de datos • https://github.com/TCSWT/Learning-Management-System/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16971 – Wisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference
https://notcve.org/view.php?id=CVE-2018-16971
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter. Wisetail Learning Ecosystem (LE) hasta la versión v4.11.6 permite ataques IDOR (Insecure Direct Object Reference) para acceder a contenidos (quiz / test) de cursos no comprados mediante un parámetro id modificado. Wisetail Learning Ecosystem (LE) versions up to 4.11.6 suffer from multiple insecure direct object reference vulnerabilities that allow an attacker to download files and get access to the non-purchased course quiz test via a modified id parameter. • https://blog.ziaurrashid.com/wisetail-learning-ecosystem-multiple-idor-vunlerability • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16970 – Wisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference
https://notcve.org/view.php?id=CVE-2018-16970
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter. Wisetail Learning Ecosystem (LE) hasta la versión v4.11.6 permite ataques IDOR (Insecure Direct Object Reference) para descargar archivos de cursos no comprados mediante un parámetro id modificado. Wisetail Learning Ecosystem (LE) versions up to 4.11.6 suffer from multiple insecure direct object reference vulnerabilities that allow an attacker to download files and get access to the non-purchased course quiz test via a modified id parameter. • https://blog.ziaurrashid.com/wisetail-learning-ecosystem-multiple-idor-vunlerability • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •