Advisories · Technology
themeum Tutor LMS – eLearning and online course solution.
Every CVE that names themeum Tutor LMS – eLearning and online course solution among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.4 Medium
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.1 Medium
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.5 Medium
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 8.8 High
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
- themeum Tutor LMS – eLearning and online course solution
- Insecure deserialization
- CVSS 6.5 Medium
Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
- themeum Tutor LMS – eLearning and online course solution
- Other injection
- CVSS 4.9 Medium
Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 6.5 Medium
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 6.4 Medium
Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 5.3 Medium
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.3 Medium
Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.5 Medium
Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 4.3 Medium
Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.4 Medium
Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 7.5 High
Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 7.5 High
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 5.3 Medium
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
- themeum Tutor LMS – eLearning and online course solution
- Information disclosure
- CVSS 8.1 High
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.4 Medium
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.5 Medium
Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.3 Medium
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 5.3 Medium
Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
- themeum Tutor LMS – eLearning and online course solution
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 7.2 High
Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Tutor LMS <= 2.7.0 - Missing Authorization
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 8.8 High
Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 6.5 Medium
Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 6.5 Medium
Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.4 Medium
Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 8.8 High
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 5.4 Medium
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 4.3 Medium
Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
- themeum Tutor LMS – eLearning and online course solution
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Tutor LMS <= 2.6.0 - Missing Authorization
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 5.4 Medium
Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
- themeum Tutor LMS – eLearning and online course solution
- Other injection
- CVSS 5.9 Medium
WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
- Themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
-
Tutor LMS < 1.8.8 - Authenticated Local File Inclusion
- Themeum Tutor LMS – eLearning and online course solution
- Path traversal