CVE-2020-27481
CRITICAL EXPLOITED NUCLEIGood Layers LMS Plugin <= 2.1.4 - SQL Injection
Title source: llmDescription
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Nuclei Templates (1)
Good Layers LMS Plugin <= 2.1.4 - SQL Injection
CRITICALby edoardottt
Scores
CVSS v3
9.8
EPSS
0.5775
EPSS Percentile
98.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
VulnCheck KEV
2020-10-10
Classification
CWE
CWE-89
Status
published
Affected Products (1)
goodlayers/good_learning_management_system
< 2.1.4
Timeline
Published
Nov 12, 2020
Tracked Since
Feb 18, 2026