The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
The company that operates online learning system Canvas said it struck a deal with hackers to delete the data they pilfered in a cyberattack that created chaos for students, many of them in the middle of finals. The post Deal Reached With Hackers to Delete Data Stolen From the Canvas Educational Platform appeared first on SecurityWeek .
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin up to version 1.0.3 has a missing authorization vulnerability. A REST API endpoint uses a permission callback that always returns true, bypassing authentication and authorization. This allows unauthenticated attackers to delete any classroom record by specifying its ID, causing permanent data loss. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS.
Fix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL).
This issue affects pgAdmin 4: before 9.15.
Tens of thousands of students studying for final exams around the world have regained access to a key online learning system after a cyberattack had earlier knocked it offline. The post Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools appeared first on SecurityWeek .
CVE-2026-8262 is a medium-severity cross-site scripting (XSS) vulnerability in Devs Palace ERP Online version 4.0.0 and earlier. The vulnerability exists in an unspecified function within the /accounts/chart-save file, allowing remote attackers to inject malicious scripts. The exploit code is publicly available, but there are no known exploits in the wild. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is currently available.
CVE-2026-8256 is a medium severity cross-site scripting (XSS) vulnerability in Devs Palace ERP Online version 4.0.0 and earlier. The vulnerability exists in an unspecified part of the /accounts/mr-save file, allowing remote attackers to inject malicious scripts. The vendor has not responded to the disclosure, and no official patch or remediation is currently available. The vulnerability has been publicly disclosed but there are no known exploits in the wild at this time.
CVE-2026-8255 is a medium severity cross-site scripting (XSS) vulnerability in Devs Palace ERP Online version 4.0.0. The issue exists in an unspecified part of the /inventory/add_new_customer file and can be exploited remotely. The vulnerability allows an attacker to inject malicious scripts, potentially impacting users who interact with the affected functionality. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available. Public exploit code exists, but no known exploitation in the wild has been reported.
CVE-2026-8254 is a medium severity cross-site scripting (XSS) vulnerability in Devs Palace ERP Online version 4.0.0. The issue exists in an unspecified functionality of the /inventory/sales_save file and can be exploited remotely. The vendor has not responded to the vulnerability disclosure, and no patch or official remediation is currently available. Public exploit code has been released, increasing the risk of attacks. The vulnerability requires high privileges and user interaction to exploit, and it does not affect confidentiality or availability directly.
CVE-2026-8253 is a medium severity cross-site scripting (XSS) vulnerability in Devs Palace ERP Online version 4.0.0. The vulnerability exists in an unspecified functionality related to the /inventory/purchase_save file and can be exploited remotely. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is currently available. Exploit code is publicly accessible, but there are no known exploits in the wild at this time.
A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
A cross-site scripting (XSS) vulnerability exists in Devs Palace ERP Online versions up to 4.0.0 in the /inventory/customer-save endpoint. The vulnerability allows remote attackers to inject malicious scripts. The vendor has not responded to disclosure attempts, and public exploit code is available. The CVSS score is low (2.4), indicating limited impact.
A cross-site scripting (XSS) vulnerability exists in Devs Palace ERP Online up to version 4.0.0 in the /inventory/item-save file. This flaw allows remote attackers to perform script injection. The vendor was notified but did not respond, and public exploit code has been published. The vulnerability has a low CVSS score of 2.4.