Advisories · Technology
Tutor LMS.
Every CVE that names Tutor LMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
- Tutor LMS
- Information disclosure
- CVSS 7.5 High
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
- Tutor LMS
- Broken access control
- CVSS 6.5 Medium
Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR
- Tutor LMS
- Broken access control
- CVSS 4.3 Medium
Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure
- Tutor LMS
- Information disclosure
- CVSS 7.2 High
Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
- Tutor LMS
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
- Tutor LMS
- Other injection
- CVSS 5.3 Medium
Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters
- Tutor LMS
- SQL injection
- CVSS 6.8 Medium
Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
- Tutor LMS
- Information disclosure
- CVSS 2.7 Low
Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
- Tutor LMS
- Broken access control
- CVSS 4.3 Medium
Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
- Tutor LMS
- Broken access control
- CVSS 5.4 Medium
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
- Tutor LMS
- Broken access control
- CVSS 7.1 High
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
- Tutor LMS
- CVSS 6.5 Medium
Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
- Tutor LMS
- CVSS 4.3 Medium
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
- Tutor LMS
- CVSS 5.4 Medium
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
- Tutor LMS
- CVSS 5.4 Medium
Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting
- Tutor LMS
-
Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API
- Tutor LMS
- CVSS 6.1 Medium
Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting
- Tutor LMS