Medium
CVE-2026-104915
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 32
Reset filters
Medium
CVE-2026-104022
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Medium
CVE-2026-104049
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-104050
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
1f0a1439-d10c-4dfc-9a40-7319debe3c51
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Medium
CVE-2026-12376
Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16563
Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure
Medium
CVE-2026-9341
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
Medium
CVE-2026-5348
Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
Medium
CVE-2026-14184
Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification
High
CVE-2026-39598
Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload
Medium
CVE-2026-25372
Academy LMS <= 3.5.3 - Missing Authorization
Critical
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-68527
Academy LMS <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12098
Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'
High
CVE-2025-12099
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
High
CVE-2025-11086
Academy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon
Medium
CVE-2025-59562
Academy LMS <= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object Reference
High
CVE-2024-10913
Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'
Medium
CVE-2024-43298
Clone <= 2.4.5 - Missing Authorization
Low
CVE-2024-38701
Academy LMS <= 2.0.4 - Missing Authorization
High
CVE-2024-37234
Academy LMS <= 2.0.10 - Open Redirect
Medium
CVE-2024-35171
Academy LMS <= 1.9.25 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2024-33912
Academy LMS <= 1.9.16 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.