Academy Lms
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:academy_lms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Academy Lms (5dbc8e0d-5d64-511c-acba-18d7470b24cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16563 |
vulnerable | 2026-09-16 04:32:57.084096 |
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
Published: 2026-08-03T06:00:14.281Z
Updated: 2026-08-03T16:59:40.724Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12376 |
vulnerable | 2026-09-16 04:32:51.727066 |
Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.
Published: 2026-07-31T06:00:11.328Z
Updated: 2026-07-31T17:43:31.961Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14184 |
vulnerable | 2026-07-29 00:26:16.856014 |
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Published: 2026-07-21T06:00:01.905Z
Updated: 2026-07-21T15:43:25.999Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.