Show filters
74 Total Results
Displaying 51-60 of 74
Sort by:
Attacker Value
Unknown
CVE-2023-25800
Disclosure Date: November 03, 2023 (last updated November 15, 2023)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.
0
Attacker Value
Unknown
CVE-2023-25700
Disclosure Date: November 03, 2023 (last updated November 14, 2023)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
0
Attacker Value
Unknown
CVE-2023-4805
Disclosure Date: October 16, 2023 (last updated October 21, 2023)
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
0
Attacker Value
Unknown
CVE-2021-24916
Disclosure Date: August 07, 2023 (last updated October 08, 2023)
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
0
Attacker Value
Unknown
CVE-2023-3133
Disclosure Date: July 04, 2023 (last updated October 08, 2023)
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
0
Attacker Value
Unknown
CVE-2023-0236
Disclosure Date: February 06, 2023 (last updated October 08, 2023)
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
0
Attacker Value
Unknown
CVE-2022-3830
Disclosure Date: December 05, 2022 (last updated October 08, 2023)
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
0
Attacker Value
Unknown
CVE-2022-40963
Disclosure Date: October 21, 2022 (last updated December 22, 2024)
Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.
0
Attacker Value
Unknown
CVE-2022-2563
Disclosure Date: October 17, 2022 (last updated February 24, 2025)
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
0
Attacker Value
Unknown
CVE-2021-25017
Disclosure Date: January 24, 2022 (last updated February 23, 2025)
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
0
