https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:31:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336364 EUVD-2026-336364 https://cve.radiocsirt.org/vuln/euvd-2026-336364 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9341 <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the &#39;save_lesson_note&#39;, &#39;get_lesson_note&#39;, and &#39;complete_lesson_video&#39; AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.</p> <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the &#39;save_lesson_note&#39;, &#39;get_lesson_note&#39;, and &#39;complete_lesson_video&#39; AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9341 https://cve.radiocsirt.org/vuln/ghsa-jvgv-xrf5-mp7h <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the &#39;save_lesson_note&#39;, &#39;get_lesson_note&#39;, and &#39;complete_lesson_video&#39; AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.</p> <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the &#39;save_lesson_note&#39;, &#39;get_lesson_note&#39;, and &#39;complete_lesson_video&#39; AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.</p> https://cve.radiocsirt.org/vuln/ghsa-jvgv-xrf5-mp7h