CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50875 – WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50875
22 Dec 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0. La neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en Automattic Sensei LMS – Online Courses, Quizzes, & Learning permite almacenar XSS. Este problema afecta a Se... • https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2022-2034 – Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
https://notcve.org/view.php?id=CVE-2022-2034
04 Aug 2022 — The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers El plugin Sensei LMS de WordPress versiones anteriores a 4.5.0, no presenta los permisos apropiados establecidos en uno de sus endpoints REST, lo que permite a usuarios no autenticados acceder a los mensajes privados enviados a los profesores The Sensei LMS plugin for WordPress is vulnerable to Sensitive Data Exposure in ver... • https://hackerone.com/reports/1590237 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2080 – Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR
https://notcve.org/view.php?id=CVE-2022-2080
04 Aug 2022 — The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student El plugin Sensei LMS de WordPress versiones anteriores a 4.5.2, no asegura que el remitente de un mensaje privado sea el profesor o el remitente original, permitiendo que cualquie... • https://hackerone.com/reports/1592596 • CWE-639: Authorization Bypass Through User-Controlled Key CWE-862: Missing Authorization •