CVE Database /
CVE-2021-24183
CVE · Medium
CVE-2021-24183 — Tutor LMS – eLearning and online course solution [tutor] < 1.8.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24183
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
6.5
|
< 1.8.3
|
1.8.3 |
2021-03-15 |
—
|
CVE-2021-24183
The Tutor LMS plugin before version 1.8.3 contained a SQL injection vulnerability in the tutor_quiz_builder_get_question_form AJAX function that could be exploited by students through UNION-based attacks. This flaw allowed authenticated users with student-level privileges to execute arbitrary SQL queries against the database. The vulnerability was patched in version 1.8.3 and later releases.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings