CVE Database /
CVE-2021-24185
CVE · Medium
CVE-2021-24185 — Tutor LMS – eLearning and online course solution [tutor] < 1.7.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24185
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
6.5
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
CVE-2021-24185
The tutor_place_rating AJAX function in Tutor LMS versions prior to 1.7.7 contained SQL injection vulnerabilities that allowed student users to execute blind and time-based attacks against the database. These flaws enabled attackers to manipulate SQL queries through unsanitized input parameters in the vulnerable AJAX action. The vulnerability was remedied in version 1.7.7 and later releases.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings