CVE · Medium
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2021-25017 | Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.9.12 | 1.9.12 | 2021-12-27 | — |
The Tutor LMS plugin prior to version 1.9.12 fails to properly sanitize the search parameter when displaying it within an attribute on administrator pages, allowing attackers to inject malicious scripts that execute in the context of an admin user's browser session.
Based on public CVE data (MITRE/NVD).
No signup, no credit card — enter your URL and get a security report in seconds.