Medium
CVE-2026-40766
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 94
Reset filters
Medium
CVE-2026-4817
MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
Medium
CVE-2026-39524
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization
Medium
CVE-2026-5167
Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
High
CVE-2026-4484
Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
Medium
CVE-2026-0559
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
Medium
CVE-2025-13766
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
Medium
CVE-2025-64270
Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2025-64366
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
Medium
CVE-2025-59575
MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure
Medium
CVE-2025-64214
MasterStudy LMS Pro < 4.7.16 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2025-64213
MasterStudy LMS Pro < 4.7.16 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64212
MasterStudy LMS Pro < 4.7.16 - Missing Authorization
Medium
CVE-2025-59576
MasterStudy LMS <= 3.6.20 - Missing Authorization
Medium
CVE-2025-59577
MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews
Medium
CVE-2025-54744
MasterStudy LMS <= 3.6.15 - Missing Authorization
Medium
CVE-2025-54699
Masteriyo - LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-7438
MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-53209
Masteriyo LMS PRO <= 2.20.0 - Unauthenticated Privilege Escalation
High
CVE-2025-4800
MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-32237
MasterStudy LMS <= 3.5.28 - Missing Authorization
High
CVE-2025-32141
MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-10000
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality
High
CVE-2024-10008
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.