High
CVE-2026-42702
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 124
Reset filters
Medium
CVE-2026-18439
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Medium
CVE-2026-89081
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Medium
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Medium
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Medium
CVE-2026-85572
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-85569
Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion
High
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Medium
CVE-2026-19093
Tutor LMS – eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read
Medium
CVE-2026-16759
Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
Critical
CVE-2026-19092
Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation
High
CVE-2026-19094
Tutor LMS – eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection
Medium
CVE-2026-14187
Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference
Medium
CVE-2026-14310
Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization
Medium
CVE-2026-15444
Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
Medium
CVE-2026-1372
Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
Medium
CVE-2026-15022
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
Medium
CVE-2026-57694
Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-14306
Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13443
Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
Medium
CVE-2026-12271
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
Medium
CVE-2026-12274
Tutor LMS <= 3.9.12 - Authenticated (Instructor+) Insecure Direct Object Reference
Medium
CVE-2026-12273
Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation
Medium
CVE-2026-12275
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.