CloudMap 漏洞情报库

严重CVE-2024-248822026/01/14

Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_logged_in_user() function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

masteriyoPoC 已收录

CVSS—

中危CVE-2024-339392025/05/19

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3.

masteriyoPoC 已收录

CVSS5.3

中危CVE-2023-33452023/07/31

LMS by Masteriyo < 1.6.8 - Information Exposure

The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints.

masteriyoPoC 已收录

CVSS6.5EPSS 64.9%

masteriyo

关联漏洞

Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

LMS by Masteriyo < 1.6.8 - Information Exposure