TL
Product
Tutor LMS
17
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 1High 4Medium 11Low 1
Watch
Add Tutor LMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19092 | 9.8 | Aug 27 | Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing Affected: 2.1.3 before 4.0.6 |
| CVE-2026-96537 | 7.5 | Oct 15 | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite Affected: before 4.1.1 |
| CVE-2023-3133 | 7.5 | Jul 4 | Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API Affected: before 2.2.1 |
| CVE-2026-85569 | 7.2 | Sep 16 | Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification Affected: 2.7.1 before 4.0.8 |
| CVE-2026-12275 | 7.1 | Jul 13 | Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration Affected: before 3.9.13 |
| CVE-2026-19093 | 6.8 | Aug 22 | Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path Affected: before 4.0.6 |
| CVE-2026-85571 | 6.5 | Oct 10 | Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR Affected: 4.0.5 before 4.1.1 |
| CVE-2026-12274 | 6.5 | Jul 13 | Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR Affected: before 3.9.13 |
| CVE-2023-0236 | 6.1 | Feb 6 | Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting Affected: before 2.0.10 |
| CVE-2026-14310 | 5.4 | Jul 30 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection Affected: before 4.0.0 |
| CVE-2026-12271 | 5.4 | Jul 13 | Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR Affected: before 3.9.13 |
| CVE-2023-4805 | 5.4 | Oct 16 | Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting Affected: before 2.3.0 |
| CVE-2026-19094 | 5.3 | Aug 26 | Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters Affected: 4.0.0 before 4.0.6 |
| CVE-2026-85572 | 4.3 | Sep 16 | Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure Affected: 4.0.0 before 4.0.8 |
| CVE-2026-14306 | 4.3 | Aug 6 | Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass Affected: before 3.9.14 |
| CVE-2026-12273 | 4.3 | Jul 13 | Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation Affected: before 3.9.13 |
| CVE-2026-14187 | 2.7 | Aug 22 | Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR Affected: before 4.0.6 |
Showing 17