Description
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, authenticated remote attackers to modify a specific parameter to obtain a course invitation code, thereby joining any course.
References (2)
Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10720-ecdfd-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-10721-276b6-2.html
Scores
CVSS v3
5.4
EPSS
0.0017
EPSS Percentile
7.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-639
Status
published
Products (1)
WisdomGarden/Tronclass
< 1.74
Published
Feb 23, 2026
Tracked Since
Feb 23, 2026