Vulnerabilities > Themeum > Tutor LMS
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-10 | CVE-2023-2919 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. | 4.3 |
| 2024-08-26 | CVE-2024-39645 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. | 8.8 |
| 2024-07-09 | CVE-2024-37266 | Path Traversal vulnerability in Themeum Tutor LMS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1. | 7.2 |
| 2024-07-09 | CVE-2024-37256 | SQL Injection vulnerability in Themeum Tutor LMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1. | 7.2 |
| 2024-06-11 | CVE-2023-25799 | Missing Authorization vulnerability in Themeum Tutor LMS Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8. | 8.8 |
| 2024-06-07 | CVE-2024-5438 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. | 4.3 |
| 2024-06-07 | CVE-2024-4902 | SQL Injection vulnerability in Themeum Tutor LMS The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 7.2 |
| 2023-12-15 | CVE-2023-49829 | Cross-site Scripting vulnerability in Themeum Tutor LMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored XSS.This issue affects Tutor LMS – eLearning and online course solution: from n/a through 2.2.4. | 4.8 |
| 2023-11-03 | CVE-2023-25700 | SQL Injection vulnerability in Themeum Tutor LMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10. | 9.8 |
| 2023-11-03 | CVE-2023-25800 | SQL Injection vulnerability in Themeum Tutor LMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0. | 8.8 |