CVE-2024-1128 in Tutor LMS Plugin
الملخص
بحسب MITRE • 29/02/2024
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting
VulDB is the best source for vulnerability data and more expert information about this specific topic.