Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3532 State: PUBLISHED Published: 2024-04-10T01:31:06.300Z Last Updated: 2024-08-01T20:12:07.575Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Online Student Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Campcodes Complete Online Student Management System 1.0. Affected is an unknown function of the file attendance_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259902 is the identifier assigned to this vulnerability. Add
ploit has been disclosed to the public and may be used. VDB-259902 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259902 - https://vuldb.com/?ctiid.259902 - https://vuldb.com/?submit.312523 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Student%20Management%20System/Complete%20Online%20Student%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2024-3533 State: PUBLISHED Published: 2024-04-10T02:00:04.630Z Last Updated: 2024-08-27T15:58:02.768Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Online Student Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Complete Online Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file academic_year_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259903. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259903 - https://vuldb.com/?ctiid.259903 - https://vuldb.com/?submit.312524 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Student%20Management%20System/Complete%20Online%20Student%20Management%20System%20-%20vuln%206.pdf
CVE ID: CVE-2024-3534 State: PUBLISHED Published: 2024-04-10T02:31:04.876Z Last Updated: 2024-08-01T20:12:07.634Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Campcodes Church Management System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259904. Additional Analyst Notes: - CISA ADP Vulnri
public and may be used. The identifier of this vulnerability is VDB-259904. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259904 - https://vuldb.com/?ctiid.259904 - https://vuldb.com/?submit.312535 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-3535 State: PUBLISHED Published: 2024-04-10T03:00:05.144Z Last Updated: 2024-08-01T20:12:07.690Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259905 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnric
may be used. The identifier VDB-259905 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259905 - https://vuldb.com/?ctiid.259905 - https://vuldb.com/?submit.312536 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2024-3536 State: PUBLISHED Published: 2024-04-10T03:31:04.604Z Last Updated: 2024-08-01T20:12:07.759Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability has been found in Campcodes Church Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/delete_log.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259906 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnr
and may be used. VDB-259906 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259906 - https://vuldb.com/?ctiid.259906 - https://vuldb.com/?submit.312537 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%203.pdf
CVE ID: CVE-2024-3537 State: PUBLISHED Published: 2024-04-10T04:00:05.135Z Last Updated: 2024-08-01T20:12:07.852Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Church Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/admin_user.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259907. Additional Analyst Notes: - CISA ADP Vuln
nd may be used. The associated identifier of this vulnerability is VDB-259907. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259907 - https://vuldb.com/?ctiid.259907 - https://vuldb.com/?submit.312538 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%204.pdf
CVE ID: CVE-2024-3538 State: PUBLISHED Published: 2024-04-10T04:31:05.223Z Last Updated: 2024-08-01T20:12:07.653Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/addTithes.php. The manipulation of the argument na leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259908. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
may be used. The identifier of this vulnerability is VDB-259908. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259908 - https://vuldb.com/?ctiid.259908 - https://vuldb.com/?submit.312539 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2024-3539 State: PUBLISHED Published: 2024-04-10T05:00:04.707Z Last Updated: 2024-08-01T20:12:07.633Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addgiving.php. The manipulation of the argument amount leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259909 was assigned to this vulnerability. Additional Analyst Notes
ed to the public and may be used. The identifier VDB-259909 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259909 - https://vuldb.com/?ctiid.259909 - https://vuldb.com/?submit.312540 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%206.pdf
CVE ID: CVE-2024-3540 State: PUBLISHED Published: 2024-04-10T05:00:06.098Z Last Updated: 2024-08-01T20:12:07.473Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Church Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_sundaysch.php. The manipulation of the argument Gender leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259910 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CI
the public and may be used. VDB-259910 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259910 - https://vuldb.com/?ctiid.259910 - https://vuldb.com/?submit.312541 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%207.pdf
CVE ID: CVE-2024-3541 State: PUBLISHED Published: 2024-04-10T05:31:05.183Z Last Updated: 2024-08-01T20:12:07.672Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Church Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/admin_user.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259911. Additional Analyst Notes: - CISA ADP
lic and may be used. The associated identifier of this vulnerability is VDB-259911. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259911 - https://vuldb.com/?ctiid.259911 - https://vuldb.com/?submit.312542 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%208.pdf
CVE ID: CVE-2024-3542 State: PUBLISHED Published: 2024-04-10T06:00:05.433Z Last Updated: 2024-08-01T20:12:07.655Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Church Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Church Management System 1.0. This vulnerability affects unknown code of the file /admin/add_visitor.php. The manipulation of the argument mobile leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259912. Additional Analyst Notes: - CISA ADP Vulnrichment: -
d may be used. The identifier of this vulnerability is VDB-259912. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259912 - https://vuldb.com/?ctiid.259912 - https://vuldb.com/?submit.312544 - https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%209.pdf
CVE ID: CVE-2024-3543 State: PUBLISHED Published: 2024-05-02T14:05:26.748Z Last Updated: 2024-08-08T14:59:24.596Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: LoadMaster Problem Types: CWE-257 Description: Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kemptechnologies.com/ - https://support.kemptechnologies.com/hc/en-us/articles/257248135186
hment: References: - https://kemptechnologies.com/ - https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543
CVE ID: CVE-2024-3544 State: PUBLISHED Published: 2024-05-02T14:08:06.683Z Last Updated: 2024-08-01T20:12:07.654Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: LoadMaster Problem Types: CWE-798 Description: Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed. Additional Analyst Notes: - CISA ADP Vulnrichm
must be exchanged between the partners before communication can proceed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kemptechnologies.com/ - https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543
CVE ID: CVE-2024-3545 State: PUBLISHED Published: 2024-04-09T19:01:43.329Z Last Updated: 2024-11-04T16:46:03.419Z Vendors: Devolutions Products: Server, Remote Desktop Manager Description: Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0006
CVE ID: CVE-2024-3546 State: PUBLISHED Published: 2024-05-02T16:51:57.352Z Last Updated: 2024-08-01T20:12:07.631Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: webtoffee Products: WordPress Backup & Migration Problem Types: CWE-862 Missing Authorization Description: The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file n
scriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/339c4eba-fa34-4db6-be4b-bcf0ba98121a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3073573%40wp-migration-duplicator%2Ftrunk&old=3049128%40wp-migration-duplicator%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3547 State: PUBLISHED Published: 2024-05-10T07:33:39.783Z Last Updated: 2024-08-01T20:12:07.678Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes
er in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f629fc93-84ce-4c33-b1c0-3a3194aac477?source=cve - https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_settings_output.class.php
CVE ID: CVE-2024-3548 State: PUBLISHED Published: 2024-05-15T06:00:03.437Z Last Updated: 2025-03-27T14:35:09.325Z Vendors: Unknown Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9eef8b29-2c62-4daa-ae90-467ff9be18d8/
CVE ID: CVE-2024-3549 State: PUBLISHED Published: 2024-06-11T06:44:16.351Z Last Updated: 2024-08-09T19:13:52.654Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This ma
sufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b472eb8-9808-4a50-b2b4-0b0b3256053f?source=cve - https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/B2S/Post/Item.php
CVE ID: CVE-2024-3550 State: PUBLISHED Published: 2024-05-02T16:52:33.461Z Last Updated: 2024-08-01T20:12:07.691Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac
cient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7b0f1b-a6d3-4a96-adaa-0adeb6ea2efd?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/functions-html.php#L51 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L71 - https://plugins.trac.w
ugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L71 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/service.php#L93 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/dailymotion.php#L141 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069959%40shortcodes-ultimate%2Ftrunk&old=3069892%40shortcodes-ultimate%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3551 State: PUBLISHED Published: 2024-05-17T02:03:10.400Z Last Updated: 2024-08-01T20:12:07.722Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pencidesign Products: Penci Soledad Data Migrator Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in tho
henticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f8df3a-f247-4365-a9f6-6124065b4883?source=cve - https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398
CVE ID: CVE-2024-3552 State: PUBLISHED Published: 2024-06-13T06:00:02.709Z Last Updated: 2025-03-25T14:04:25.515Z Vendors: Unknown Products: Web Directory Free Problem Types: CWE-89 SQL Injection Description: The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/
CVE ID: CVE-2024-3553 State: PUBLISHED Published: 2024-05-02T16:52:53.256Z Last Updated: 2024-08-01T20:12:07.680Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-862 Missing Authorization Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled. Additional Analyst Notes: - C