TL
Product
Tutor LMS – eLearning and online course solution
31
CVEs
0
On KEV
8.8
Max CVSS
4
New 30D
Severity mix
Critical 0High 4Medium 27Low 0
Watch
Add Tutor LMS – eLearning and online course solution to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-89333 | 6.5 | Sep 19 | Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter Affected: through 4.0.8 |
| CVE-2026-16759 | 6.5 | Aug 28 | Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters Affected: through 4.0.5 |
| CVE-2026-15022 | 6.5 | Jul 16 | Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array Affected: through 4.0.0 |
| CVE-2026-6080 | 6.5 | Apr 17 | Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter Affected: through 3.9.8 |
| CVE-2025-13679 | 6.5 | Jan 8 | Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details Affected: through 3.9.3 |
| CVE-2026-93681 | 6.4 | Oct 16 | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter Affected: through 4.1.0 |
| CVE-2026-13443 | 6.4 | Jul 1 | Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title Affected: through 3.9.13 |
| CVE-2026-88963 | 6.1 | Oct 16 | Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter Affected: through 4.0.8 |
| CVE-2026-89081 | 6.1 | Sep 19 | Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters Affected: through 4.0.8 |
| CVE-2026-3358 | 5.4 | Apr 11 | Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment Affected: through 3.9.7 |
| CVE-2026-0548 | 5.4 | Jan 20 | Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion Affected: through 3.9.4 |
| CVE-2026-6965 | 5.3 | May 13 | Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter Affected: through 3.9.9 |
| CVE-2026-5502 | 5.3 | Apr 17 | Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order Affected: through 3.9.8 |
| CVE-2026-1371 | 5.3 | Feb 3 | Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action Affected: through 3.9.5 |
| CVE-2025-11564 | 5.3 | Oct 25 | Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update Affected: through 3.8.3 |
| CVE-2026-15444 | 4.9 | Jul 28 | Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter Affected: through 4.0.1 |
| CVE-2026-10736 | 4.9 | Jun 18 | Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter Affected: through 3.9.11 |
| CVE-2026-100193 | 4.7 | Oct 14 | Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter Affected: through 4.1.0 |
| CVE-2026-92715 | 4.3 | Oct 17 | Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter Affected: through 4.1.0 |
| CVE-2026-18439 | 4.3 | Sep 22 | Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter Affected: through 4.0.7 |
| CVE-2026-88944 | 4.3 | Sep 19 | Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter Affected: through 4.0.8 |
| CVE-2026-3371 | 4.3 | Apr 11 | Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification Affected: through 3.9.7 |
| CVE-2025-13935 | 4.3 | Jan 9 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion Affected: through 3.9.2 |
| CVE-2025-13934 | 4.3 | Jan 9 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass Affected: through 3.9.3 |
| CVE-2025-13628 | 4.3 | Jan 9 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification Affected: through 3.9.3 |
| CVE-2025-6680 | 4.3 | Oct 25 | Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure Affected: through 3.8.3 |
| CVE-2023-2919 | 4.3 | Sep 10 | Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' Affected: through 2.7.4 |
Showing 27