Sign in Free assessment

GoodLayers records

7 published records for vendor goodlayers.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 71.4%
Median publish → KEV: No record has entered KEV

Records by year

20
25

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
42Plan	CVE-2020-27481Proof of concept	An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPrgoodlayers · good learning management system · CWE-89 Pre-auth SQL injection	Critical9.8	—	10.0%	Nov 12, 2020
35Monitor	CVE-2024-13369No exploit	Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parametergoodlayers · tour master · CWE-89 SQL injection	High8.8	—	0.5%	Feb 18, 2025
28Monitor	CVE-2024-12400No exploit	Tourmaster < 5.3.5 - Reflected XSSgoodlayers · tour master · CWE-79 Pre-auth XSS	High7.1	—	0.3%	Jan 30, 2025
26Monitor	CVE-2024-12163No exploit	GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Uploadgoodlayers · goodlayers core · CWE-79 XSS	Medium6.5	—	0.3%	Jan 30, 2025
24Monitor	CVE-2024-11846No exploit	Travel Tour < 5.2.4 - Reflected XSSgoodlayers · travel tour · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jan 1, 2025
24Monitor	CVE-2024-11356No exploit	Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Bookinggoodlayers · tour master · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jan 6, 2025
23Monitor	CVE-2024-11357No exploit	Goodlayers Core < 2.0.10 - Contributor+ Stored XSSgoodlayers · goodlayers core · CWE-79 XSS	Medium5.9	—	0.3%	Jan 2, 2025

CVE-2020-27481
42Plan
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPr
CriticalCVSS 9.8Proof of conceptEPSS 10%
- Pre-auth
- SQL injection
goodlayers · good learning management systemNov 12, 2020
CVE-2024-13369
35Monitor
Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
goodlayers · tour masterFeb 18, 2025
CVE-2024-12400
28Monitor
Tourmaster < 5.3.5 - Reflected XSS
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
goodlayers · tour masterJan 30, 2025
CVE-2024-12163
26Monitor
GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload
MediumCVSS 6.5No exploitEPSS 0%
- XSS
goodlayers · goodlayers coreJan 30, 2025
CVE-2024-11846
24Monitor
Travel Tour < 5.2.4 - Reflected XSS
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
goodlayers · travel tourJan 1, 2025
CVE-2024-11356
24Monitor
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
goodlayers · tour masterJan 6, 2025
CVE-2024-11357
23Monitor
Goodlayers Core < 2.0.10 - Contributor+ Stored XSS
MediumCVSS 5.9No exploitEPSS 0%
- XSS
goodlayers · goodlayers coreJan 2, 2025