First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-2034

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Sensei LMS	< 4.5.0

References

https://hackerone.com/reports/1590237Exploit, Third Party Advisory
https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426Exploit, Third Party Advisory
https://hackerone.com/reports/1590237Exploit, Third Party Advisory
https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426Exploit, Third Party Advisory

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-203403.3In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. Th CVE-2022-203415.5In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local inform CVE-2022-203423.3In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local informat CVE-2022-203447.0In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This cou CVE-2022-203458.8In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co CVE-2022-203466.5In updateAudioTrackInfoFromESDS_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check. T CVE-2022-203478.8In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to rem CVE-2022-203487.8In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permi CVE-2022-203497.8In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing CVE-2022-20356.1A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCO CVE-2022-203505.5In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the CVE-2022-203515.5In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection. This could lead to local