Pearson operates a portfolio of education and assessment software, including student information systems, proctoring platforms, and testing products that handle sensitive learner data and credentials. The vulnerability profile centers on web-application weaknesses such as cross-site scripting, SQL injection, and improper permission assignment, reflecting the input-handling and access-control surface area typical of data-rich educational platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pearson over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-36154HIGH The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which allows local users to ob | Jan 4, 2021 | 7.8 | 24 | NO | NO |
CVE-2014-1455HIGH SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to exe | Apr 10, 2014 | 7.5 | 23 | NO | NO |
CVE-2014-1454MEDIUM Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input | Jan 8, 2020 | 4.8 | 15 | NO | NO |
CVE-2015-0972MEDIUM Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a d | Jun 23, 2015 | 5.0 | 15 | NO | NO |
CVE-2014-1942MEDIUM Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script | Apr 2, 2014 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pearson.
Media articles that mention a CVE ID that affects a product developed by Pearson — matched by CVE ID, not by vendor name.