Learning Management System Lms
Monthly
Missing authorization controls in AVEZ Electronics Communication Training and Consultancy Trade Inc.'s Learning Management System (LMS) allow an authenticated low-privilege user to reach resources and records beyond their assigned privilege level, resulting in disclosure of confidential data. The flaw (CWE-862) is remotely exploitable over the network with low attack complexity, but requires a valid authenticated session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so fully unauthenticated outsiders cannot trigger it directly; impact is confined to confidentiality, with no integrity or availability effect. All LMS instances at or before the 2026-09-18 version baseline are in scope, and no public exploit code has been identified at time of analysis, though no vendor-released patch has been confirmed either.
Missing authorization controls in AVEZ Electronics Communication Training and Consultancy Trade Inc.'s Learning Management System (LMS) allow an authenticated low-privilege user to reach resources and records beyond their assigned privilege level, resulting in disclosure of confidential data. The flaw (CWE-862) is remotely exploitable over the network with low attack complexity, but requires a valid authenticated session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so fully unauthenticated outsiders cannot trigger it directly; impact is confined to confidentiality, with no integrity or availability effect. All LMS instances at or before the 2026-09-18 version baseline are in scope, and no public exploit code has been identified at time of analysis, though no vendor-released patch has been confirmed either.