agentprime: themeum-tutor-lms-elearning-and-online-course-solutionEvery new CVE for themeum-tutor-lms-elearning-and-online-course-solution.https://agentprime.io/CVE-2026-93779: Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpointshttps://agentprime.io/advisories/CVE-2026-93779/https://agentprime.io/advisories/CVE-2026-93779/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Nov 2026 04:27:13 GMTCVECVE-2026-92715: Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameterhttps://agentprime.io/advisories/CVE-2026-92715/https://agentprime.io/advisories/CVE-2026-92715/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 17 Oct 2026 03:43:27 GMTCVECVE-2026-93681: Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameterhttps://agentprime.io/advisories/CVE-2026-93681/https://agentprime.io/advisories/CVE-2026-93681/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 08:27:41 GMTCVECVE-2026-88963: Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameterhttps://agentprime.io/advisories/CVE-2026-88963/https://agentprime.io/advisories/CVE-2026-88963/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 05:30:27 GMTCVECVE-2026-100193: Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameterhttps://agentprime.io/advisories/CVE-2026-100193/https://agentprime.io/advisories/CVE-2026-100193/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 03:40:00 GMTCVECVE-2026-18439: Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameterhttps://agentprime.io/advisories/CVE-2026-18439/https://agentprime.io/advisories/CVE-2026-18439/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 07:41:12 GMTCVECVE-2026-89081: Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parametershttps://agentprime.io/advisories/CVE-2026-89081/https://agentprime.io/advisories/CVE-2026-89081/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 02:27:11 GMTCVECVE-2026-88944: Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameterhttps://agentprime.io/advisories/CVE-2026-88944/https://agentprime.io/advisories/CVE-2026-88944/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 02:27:10 GMTCVECVE-2026-89333: Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameterhttps://agentprime.io/advisories/CVE-2026-89333/https://agentprime.io/advisories/CVE-2026-89333/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 02:27:07 GMTCVECVE-2026-78175: Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-78175/https://agentprime.io/advisories/CVE-2026-78175/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 12 Sep 2026 07:39:15 GMTCVECVE-2026-16759: Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parametershttps://agentprime.io/advisories/CVE-2026-16759/https://agentprime.io/advisories/CVE-2026-16759/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 03:39:35 GMTCVECVE-2026-15444: Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameterhttps://agentprime.io/advisories/CVE-2026-15444/https://agentprime.io/advisories/CVE-2026-15444/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 28 Jul 2026 11:32:49 GMTCVECVE-2026-15022: Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Arrayhttps://agentprime.io/advisories/CVE-2026-15022/https://agentprime.io/advisories/CVE-2026-15022/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 07:51:03 GMTCVECVE-2026-13443: Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Titlehttps://agentprime.io/advisories/CVE-2026-13443/https://agentprime.io/advisories/CVE-2026-13443/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 03:43:35 GMTCVECVE-2026-10736: Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameterhttps://agentprime.io/advisories/CVE-2026-10736/https://agentprime.io/advisories/CVE-2026-10736/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 05:34:24 GMTCVECVE-2026-6965: Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameterhttps://agentprime.io/advisories/CVE-2026-6965/https://agentprime.io/advisories/CVE-2026-6965/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 05:29:37 GMTCVECVE-2026-5502: Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_orderhttps://agentprime.io/advisories/CVE-2026-5502/https://agentprime.io/advisories/CVE-2026-5502/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 03:36:45 GMTCVECVE-2026-6080: Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameterhttps://agentprime.io/advisories/CVE-2026-6080/https://agentprime.io/advisories/CVE-2026-6080/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 03:36:44 GMTCVECVE-2026-3371: Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modificationhttps://agentprime.io/advisories/CVE-2026-3371/https://agentprime.io/advisories/CVE-2026-3371/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 11 Apr 2026 01:25:01 GMTCVECVE-2026-3358: Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollmenthttps://agentprime.io/advisories/CVE-2026-3358/https://agentprime.io/advisories/CVE-2026-3358/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 11 Apr 2026 01:24:56 GMTCVECVE-2026-3360: Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameterhttps://agentprime.io/advisories/CVE-2026-3360/https://agentprime.io/advisories/CVE-2026-3360/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 01:24:58 GMTCVECVE-2025-13673: Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_codehttps://agentprime.io/advisories/CVE-2025-13673/https://agentprime.io/advisories/CVE-2025-13673/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 28 Feb 2026 07:25:35 GMTCVECVE-2026-1371: Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Actionhttps://agentprime.io/advisories/CVE-2026-1371/https://agentprime.io/advisories/CVE-2026-1371/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 07:31:23 GMTCVECVE-2026-1375: Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletionhttps://agentprime.io/advisories/CVE-2026-1375/https://agentprime.io/advisories/CVE-2026-1375/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 07:31:23 GMTCVECVE-2026-0548: Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletionhttps://agentprime.io/advisories/CVE-2026-0548/https://agentprime.io/advisories/CVE-2026-0548/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 14:26:31 GMTCVECVE-2025-13935: Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completionhttps://agentprime.io/advisories/CVE-2025-13935/https://agentprime.io/advisories/CVE-2025-13935/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Jan 2026 07:22:11 GMTCVECVE-2025-13934: Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypasshttps://agentprime.io/advisories/CVE-2025-13934/https://agentprime.io/advisories/CVE-2025-13934/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Jan 2026 07:22:11 GMTCVECVE-2025-13628: Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modificationhttps://agentprime.io/advisories/CVE-2025-13628/https://agentprime.io/advisories/CVE-2025-13628/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Jan 2026 07:22:10 GMTCVECVE-2025-13679: Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailshttps://agentprime.io/advisories/CVE-2025-13679/https://agentprime.io/advisories/CVE-2025-13679/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Jan 2026 07:04:12 GMTCVECVE-2025-11564: Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Updatehttps://agentprime.io/advisories/CVE-2025-11564/https://agentprime.io/advisories/CVE-2025-11564/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Oct 2025 05:31:19 GMTCVECVE-2025-6680: Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposurehttps://agentprime.io/advisories/CVE-2025-6680/https://agentprime.io/advisories/CVE-2025-6680/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Oct 2025 05:31:18 GMTCVECVE-2024-10400: Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterhttps://agentprime.io/advisories/CVE-2024-10400/https://agentprime.io/advisories/CVE-2024-10400/CVSS 7.5 (High). Critical: CVSS score 7.5 (7.0 or more) and EPSS 0.83 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 Nov 2024 07:35:36 GMTCVEcriticalCVE-2024-10393: Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registrationhttps://agentprime.io/advisories/CVE-2024-10393/https://agentprime.io/advisories/CVE-2024-10393/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 Nov 2024 06:49:54 GMTCVECVE-2023-2919: Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'https://agentprime.io/advisories/CVE-2023-2919/https://agentprime.io/advisories/CVE-2023-2919/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Sep 2024 09:30:19 GMTCVECVE-2024-5438: Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletionhttps://agentprime.io/advisories/CVE-2024-5438/https://agentprime.io/advisories/CVE-2024-5438/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Jun 2024 12:33:42 GMTCVECVE-2024-4902: Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injectionhttps://agentprime.io/advisories/CVE-2024-4902/https://agentprime.io/advisories/CVE-2024-4902/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Jun 2024 04:33:25 GMTCVECVE-2024-4223: Tutor LMS <= 2.7.0 - Missing Authorizationhttps://agentprime.io/advisories/CVE-2024-4223/https://agentprime.io/advisories/CVE-2024-4223/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 May 2024 08:32:50 GMTCVEcriticalCVE-2024-4318: Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injectionhttps://agentprime.io/advisories/CVE-2024-4318/https://agentprime.io/advisories/CVE-2024-4318/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 May 2024 05:33:27 GMTCVECVE-2024-4279: Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletionhttps://agentprime.io/advisories/CVE-2024-4279/https://agentprime.io/advisories/CVE-2024-4279/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 May 2024 05:33:25 GMTCVECVE-2024-3553: Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Updatehttps://agentprime.io/advisories/CVE-2024-3553/https://agentprime.io/advisories/CVE-2024-3553/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 May 2024 16:52:53 GMTCVECVE-2024-3994: Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcodehttps://agentprime.io/advisories/CVE-2024-3994/https://agentprime.io/advisories/CVE-2024-3994/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Apr 2024 09:29:58 GMTCVECVE-2024-1751: Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injectionhttps://agentprime.io/advisories/CVE-2024-1751/https://agentprime.io/advisories/CVE-2024-1751/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 Mar 2024 15:27:26 GMTCVECVE-2024-1502: Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionhttps://agentprime.io/advisories/CVE-2024-1502/https://agentprime.io/advisories/CVE-2024-1502/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 Mar 2024 23:33:50 GMTCVECVE-2024-1503: Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erasehttps://agentprime.io/advisories/CVE-2024-1503/https://agentprime.io/advisories/CVE-2024-1503/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 Mar 2024 23:33:49 GMTCVECVE-2024-1133: Tutor LMS <= 2.6.0 - Missing Authorizationhttps://agentprime.io/advisories/CVE-2024-1133/https://agentprime.io/advisories/CVE-2024-1133/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Feb 2024 18:56:49 GMTCVECVE-2024-1128: Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&Ahttps://agentprime.io/advisories/CVE-2024-1128/https://agentprime.io/advisories/CVE-2024-1128/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Feb 2024 18:56:22 GMTCVECVE-2023-49829: WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)https://agentprime.io/advisories/CVE-2023-49829/https://agentprime.io/advisories/CVE-2023-49829/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Dec 2023 15:30:36 GMTCVECVE-2021-24242: Tutor LMS < 1.8.8 - Authenticated Local File Inclusionhttps://agentprime.io/advisories/CVE-2021-24242/https://agentprime.io/advisories/CVE-2021-24242/Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Apr 2021 21:00:51 GMTCVE