CVE-2021-24186: vulnerability in Tutor LMS – eLearning and online course solution
Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Published · Updated
25Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendepss 1.3%
from disclosure to weapon
Published on NVDApr 5
VulnCheckMar 15
exploitation probability
1.3%top 31% of all CVEs
observed exploitation
yesVulnCheck
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Affected products
Unknown · Tutor LMS – eLearning and online course solutionRelated CVEs — Tutor LMS – eLearning and online course solution
In the same product, most dangerous first.
CVE-2021-24183—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_formEPSS 1.7%CVE-2021-24182—Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_questionEPSS 1.7%CVE-2021-24184—Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege EscalationEPSS 1.4%CVE-2021-24185—Tutor LMS < 1.7.7 - SQL Injection via tutor_place_ratingEPSS 1.3%CVE-2021-24181—Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correctEPSS 1.3%CVE-2021-25017—Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingEPSS 1.0%