exploitDog

CVE-2024-1128

Опубликовано: 29 фев. 2024

Источник: nvd

CVSS3: 5.4

CVSS3: 3.5

EPSS Низкий

Описание

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*

Версия до 2.6.1 (исключая)

EPSS

Процентиль: 36%

0.0015

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-w4c6-9hpf-wrhm

CVSS3: 5.4

github

почти 2 года назад

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting

EPSS

Процентиль: 36%

0.0015

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS3

Дефекты

CWE-79