CVE-2026-111603: PlayEdu 0 through 2.3

Affected technology

PlayEdu · 0 through 2.3
PlayEdu

Description’s affected range: through 2.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.