All CosmicBytez Labs articles tagged #LMS, across news, security advisories, how-to guides, and projects.
A CVSS 9.9 critical vulnerability in Koollab LMS allows authenticated module designers to upload a SCORM package containing a PHP webshell to a publicly accessible directory, achieving remote code execution on the server.
A critical CVSS 9.9 vulnerability in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe PHP deserialisation in the assessment reinforcement endpoint to write a webshell and execute arbitrary code.
A critical unauthenticated AJAX vulnerability in the Masteriyo LMS WordPress plugin allows attackers to terminate any user's session — including administrators — without any credentials.
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
A hardcoded machineKey value in KnowledgeDeliver's configuration enabled ViewState deserialization attacks leading to remote code execution and web shell.
Attackers exploited a critical zero-day vulnerability in KnowledgeDeliver LMS servers to deploy the Godzilla web shell, giving persistent backdoor access to.
A now-patched high-severity zero-day vulnerability in Digital Knowledge's KnowledgeDeliver LMS, a popular learning management system in Japan, was actively.
Instructure, the company behind the widely used Canvas learning management system, has disclosed a cybersecurity incident and is investigating its scope....
A critical (CVSS 9.6) authorization bypass vulnerability in the moodle-mod_customcert plugin allows any teacher with manage capability in a single course...