CVE-2022-28986

7.5 highEPSS 2.3%

High (7.5) in lmsdoctor 2 factor authentication. EPSS 2.3% chance of exploitation in the next 30 days.

LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2022-05-10
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

lmsdoctor:2_factor_authentication

References

https://github.com/FlaviuPopescu/CVE-2022-28986
https://github.com/FlaviuPopescu/CVE-2022-28986

Check your stack JSON