CVE Vulnerability Catalog

The MasterStudy LMS WordPress Plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

The MasterStudy LMS WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

The MasterStudy LMS WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.

Fabasoft Folio Client before 2026 does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS was optional and empty, resulting in all domains being trusted. Any website visited by a user with the client installed could invoke client functions, e.g., downloading documents, opening documents, and synchronizing files.

A flaw in Edimax BR-6428nC 1.16. The websRedirect function of the goform Handler improperly handles the submit-url argument, leading to open redirect. The attack can be launched remotely. The exploit has been published.

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, so the list of disallowed headers is the only defense. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL.

A vulnerability in MantisZip up to 0.4.5. The Path.Combine function in MainWindow.UI.cs of the Preview component leads to path traversal. The attack can be launched remotely. The exploit has been released.

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The searchBook function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit is publicly available.

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The getBooks function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed.

SigNoz versions from v0.98.0 up to v0.143.0, when configured with the opaque session tokenizer, do not revoke a user's existing login sessions when the user's password is reset with a reset token or when the user is deleted. An attacker who already holds a session token retains full access to the account, up to administrator, after a password reset until the token reaches its maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default).

A vulnerability was found in TaleLin lin-cms-spring-boot up to version 0.2.1 in the getBook function of BookController. Manipulation of the ID argument leads to improper authorization. The attack can be performed remotely and the exploit has been published.

A vulnerability was found in Forma LMS up to version 4.1.43 in the UserselectorAdmController::getDataTask function. Manipulation of the Name argument causes SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107 in the loadCfg function. Manipulation leads to information disclosure. The attack can be launched remotely.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the file /actions.json?action=assign-owner. Manipulation of the q argument leads to information disclosure. The attack can be executed remotely and the exploit has been released.