Extension WordPress
Vulnérabilités Tutor LMS – eLearning and online course solution, page 4
Cette page rassemble les failles publiées pour Tutor LMS – eLearning and online course solution, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Tutor LMS – eLearning and online course solution
80 fiches
Tutor LMS <= 2.2.0 – Authenticated (Student+) SQL Injection
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing…
*-2.2.0
2.2.1
30/05/2023
Tutor LMS <= 2.1.8 – Missing Authorization via multiple AJAX actions
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on the multiple functions in versions up to, and including, 2.1.8. This makes it possible for…
*-2.1.8
2.1.9
24/05/2023
Tutor LMS <= 2.0.9 – Reflected Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reset_key' and 'user_id' parameters (used by the password retrieval form) in versions up to, and including, 2.0.9 due to insufficient input sanitization and output…
*-2.0.9
2.0.10
12/01/2023
Tutor LMS <= 2.0.9 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the topic name and lesson name parameters in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it…
*-2.0.9
2.0.10
26/09/2022
Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 – Reflected Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 2.0.0-2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that…
2.0.0-2.0.8
2.0.9
22/08/2022
Tutor LMS <= 1.9.11 – Reflected Cross-Site Scripting
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
*-1.9.11
1.9.12
27/12/2021
Tutor LMS <= 1.9.11 – Stored Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user profile parameters in versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-1.9.11
1.9.12
27/12/2021
Tutor LMS <= 1.9.10 – Reflected Cross-Site Scripting
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
*-1.9.10
1.9.11
19/10/2021
Tutor LMS <= 1.9.8 – Admin+ Stored Cross-Site Scripting
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
[*, 1.9.9)
1.9.9
20/09/2021
Tutor LMS <= 1.9.5 – Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-1.9.5
1.9.6
09/08/2021
Tutor LMS <= 1.9.1 – Authenticated Stored Cross-Site Scripting
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor.…
*-1.9.1
1.9.2
28/06/2021
Tutor LMS <= 1.8.7 – Authenticated Local File Inclusion
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any…
*-1.8.7
1.8.8
05/04/2021
Tutor LMS <=1.8.2 – SQL Injection via tutor_answering_quiz_question/get_answer_by_id
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
[*, 1.8.3)
1.8.3
15/03/2021
Tutor LMS <=1.8.2 – SQL Injection via tutor_quiz_builder_get_answers_by_question
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
*-1.8.2
1.8.3
15/03/2021
Tutor LMS – eLearning and online course solution <= 1.7.6 – SQL Injection
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
[*, 1.7.7)
1.7.7
15/03/2021
Tutor LMS – eLearning and online course solution <=1.7.6 – SQL Injection
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
[*, 1.7.7)
1.7.7
15/03/2021
Tutor LMS <= 1.8.2 – SQL Injection via tutor_quiz_builder_get_question_form
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
*-1.8.2
1.8.3
15/03/2021
Tutor LMS – eLearning and online course solution <= 1.7.6 – Unprotected AJAX including Privilege Escalation
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
[*, 1.7.7)
1.7.7
15/03/2021
Tutor LMS <= 1.9.12 – Reflected Cross-Site Scripting
The Tutor LMS plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 1.9.12 due to missing input and output sanitization of some user generated URLs.
*-1.9.12
1.9.13
10/01/2021
Tutor LMS < 1.5.3 – Cross-Site Request Forgery
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
[*, 1.5.3)
1.5.3
04/02/2020
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.