Academy Lms
Approved changes feed: RSS · Atom
cpe:2.3:a:kodezen:academy_lms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kodezen (121ce376-df0d-58cb-889a-70deb51b3b24) |
|---|---|
| Product | Academy Lms (a7625525-bd6f-549c-bb7a-abc78b613dd0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9341 |
vulnerable | 2026-07-29 01:09:07.006978 |
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
MEDIUM (4.3)
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.
Published: 2026-07-14T11:30:42.783Z
Updated: 2026-07-14T12:45:22.307Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.