CVE-2023-3345

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	LMS by Masteriyo	< 1.6.8

References

https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65aExploit, Third Party Advisory
https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65aExploit, Third Party Advisory

Timeline

Published: Jul 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-334578.8In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.CVE-2023-33469.8Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated CVE-2023-334606.5There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.CVE-2023-334615.5iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_get CVE-2023-334668.8Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in spec CVE-2023-334689.1KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation CVE-2023-334697.8In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a vers CVE-2023-33475.9A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server s CVE-2023-334728.8An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate CVE-2023-334769.8ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation CVE-2023-334776.5In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.CVE-2023-334789.8RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.