Masteriyo - LMS

Masteriyo - LMS through 3.4.0 has a broken-access-control flaw. The vector requires no user interaction and rates integrity impact as low, but the endpoint, action, parameter, protected object, and resulting change are not disclosed.

Masteriyo - LMS through 3.4.0 permits PHP object injection. The vector requires no user interaction and rates confidentiality, integrity, and availability impact as high, but the endpoint, parameter, deserialization operation, gadget chain, and exact post-injection effect are not disclosed.

Masteriyo LMS through 2.2.0 omits a capability check in CourseProgressItemsController::delete_item_permissions_check(). An unauthenticated request can therefore delete arbitrary course-progress records belonging to any student.

Masteriyo - LMS is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is n/a through 2.3.2.

Masteriyo LMS before 2.3.3 allows an Instructor to store script-capable content in an affected quiz field. On a normal single-site installation, Masteriyo grants instructors unfiltered HTML, so the payload can execute when another user views the quiz. Multisite installations and sites defining DISALLOW_UNFILTERED_HTML are not affected by this specific path.

Masteriyo - LMS is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.3.1.

Masteriyo - LMS is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.3.0.

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.2.1.

Masteriyo - LMS is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.1.8.

Masteriyo - LMS is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.1.5.

Masteriyo - LMS is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.2.0.

Masteriyo LMS – Online Course Builder for eLearning, LMS & Education is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.1.7.

Masteriyo LMS – Online Course Builder for eLearning, LMS & Education is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated WordPress account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.1.6.

Masteriyo - LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Masteriyo - LMS is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Masteriyo LMS – eLearning and Online Course Builder for is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Masteriyo LMS – eLearning and Online Course Builder for is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Masteriyo - LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CLUEVO LMS, E-Learning Platform is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.