VendorsThemeumtutor_lmsany version
Vulnerabilities

Themeum Tutor LMS any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

49CVEs
CVE-2023-25700
WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection
Published 2023-11-03 · Modified
9.8EPSS 0.008
CVE-2024-4223
Tutor LMS <= 2.7.0 - Missing Authorization
Published 2024-05-16 · Modified
9.8EPSS 0.005
CVE-2024-1751
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
Published 2024-03-13 · Modified
8.8EPSS 0.031
CVE-2021-24184
Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
Published 2021-04-05 · Modified
8.8EPSS 0.014
CVE-2024-4352
Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection
Published 2024-05-16 · Modified
8.8EPSS 0.012
CVE-2024-4351
Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
Published 2024-05-16 · Modified
8.8EPSS 0.010
CVE-2023-25800
WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection
Published 2023-11-03 · Modified
8.8EPSS 0.007
CVE-2023-25990
WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection
Published 2023-11-03 · Modified
8.8EPSS 0.007
CVE-2024-4318
Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
Published 2024-05-16 · Modified
8.8EPSS 0.005
CVE-2023-25799
WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities
Published 2024-06-11 · Modified
8.8EPSS 0.005
CVE-2024-43142
WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability
Published 2024-11-01 · Analyzed
8.8EPSS 0.004
CVE-2024-39645
WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability
Published 2024-08-26 · Analyzed
8.8EPSS 0.002
CVE-2024-4222
Tutor LMS Pro <= 2.7.0 - Missing Authorization
Published 2024-05-16 · Modified
8.2EPSS 0.003
CVE-2024-37256
WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability
Published 2024-07-09 · Modified
7.6EPSS 0.006
CVE-2024-43282
WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability
Published 2024-08-18 · Analyzed
7.6EPSS 0.004
CVE-2024-10400
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
Published 2024-11-21 · Analyzed
7.5EPSS 0.831
CVE-2023-3133
Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API
Published 2023-07-04 · Modified
7.5EPSS 0.010
CVE-2024-37266
WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability
Published 2024-07-09 · Modified
7.2EPSS 0.006
CVE-2024-4902
Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
Published 2024-06-07 · Modified
7.2EPSS 0.005
CVE-2024-5784
Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference
Published 2024-08-30 · Analyzed
7.1EPSS 0.004
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Published 2020-02-04 · Modified
6.51 PoCEPSS 0.088
CVE-2021-24183
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form
Published 2021-04-05 · Modified
6.5EPSS 0.017
CVE-2021-24182
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question
Published 2021-04-05 · Modified
6.5EPSS 0.017
CVE-2021-24181
Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct
Published 2021-04-05 · Modified
6.5EPSS 0.013
CVE-2021-24185
Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating
Published 2021-04-05 · Modified
6.5EPSS 0.013
CVE-2021-24186
Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Published 2021-04-05 · Modified
6.5EPSS 0.013
CVE-2024-3553
Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
Published 2024-05-02 · Modified
6.5EPSS 0.005
CVE-2024-4279
Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
Published 2024-05-16 · Modified
6.5EPSS 0.004
CVE-2024-43231
WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability
Published 2024-08-12 · Analyzed
6.5EPSS 0.003
CVE-2023-0236
Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting
Published 2023-02-06 · Modified
6.1EPSS 0.013
CVE-2021-25017
Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting
Published 2022-01-24 · Modified
6.1EPSS 0.010
CVE-2021-24873
Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting
Published 2021-11-23 · Modified
6.1EPSS 0.008
CVE-2023-49829
WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
Published 2023-12-15 · Modified
5.9EPSS 0.004
CVE-2024-37947
WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
Published 2024-07-20 · Analyzed
5.9EPSS 0.004
CVE-2021-24242
Tutor LMS < 1.8.8 - Authenticated Local File Inclusion
Published 2021-04-22 · Modified
5.5EPSS 0.008
CVE-2021-24455
Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)
Published 2021-08-02 · Modified
5.4EPSS 0.007
CVE-2024-1128
Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
Published 2024-02-20 · Modified
5.4EPSS 0.005
CVE-2024-1502
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published 2024-03-12 · Modified
5.4EPSS 0.004
CVE-2023-4805
Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting
Published 2023-10-16 · Modified
5.4EPSS 0.004
CVE-2024-3994
Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
Published 2024-04-25 · Modified
5.4EPSS 0.004
1 / 2Next →