Filtered by vendor Chamilo
Subscriptions
Total
70 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-37390 | 1 Chamilo | 1 Chamilo Lms | 2024-08-04 | 6.1 Medium |
| A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). | ||||
| CVE-2021-37389 | 1 Chamilo | 1 Chamilo | 2024-08-04 | 6.1 Medium |
| Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. | ||||
| CVE-2021-35413 | 1 Chamilo | 1 Chamilo Lms | 2024-08-04 | 8.8 High |
| A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. | ||||
| CVE-2021-35415 | 1 Chamilo | 1 Chamilo Lms | 2024-08-04 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields. | ||||
| CVE-2021-35414 | 1 Chamilo | 1 Chamilo Lms | 2024-08-04 | 9.8 Critical |
| Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. | ||||
| CVE-2021-34187 | 1 Chamilo | 1 Chamilo | 2024-08-04 | 9.8 Critical |
| main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. | ||||
| CVE-2021-32925 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 6.5 Medium |
| admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. | ||||
| CVE-2021-31933 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 7.2 High |
| A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution. | ||||
| CVE-2021-26746 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 6.1 Medium |
| Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. | ||||
| CVE-2022-42029 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 8.8 High |
| Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory. | ||||
| CVE-2022-40407 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 8.8 High |
| A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. | ||||
| CVE-2022-27426 | 1 Chamilo | 1 Chamilo Lms | 2024-08-03 | 8.8 High |
| A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file. | ||||
| CVE-2022-27421 | 1 Chamilo | 1 Chamilo Lms | 2024-08-03 | 7.2 High |
| Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. | ||||
| CVE-2022-27423 | 1 Chamilo | 1 Chamilo Lms | 2024-08-03 | 9.8 Critical |
| Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php. | ||||
| CVE-2022-27422 | 1 Chamilo | 1 Chamilo Lms | 2024-08-03 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL. | ||||
| CVE-2022-27425 | 1 Chamilo | 1 Chamilo | 2024-08-03 | 6.1 Medium |
| Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. | ||||
| CVE-2023-39582 | 1 Chamilo | 1 Chamilo Lms | 2024-08-02 | 4.9 Medium |
| SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions. | ||||
| CVE-2023-39061 | 1 Chamilo | 1 Chamilo | 2024-08-02 | 3.5 Low |
| Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. | ||||
| CVE-2023-37067 | 1 Chamilo | 1 Chamilo | 2024-08-02 | 4.8 Medium |
| Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section. | ||||
| CVE-2023-37063 | 1 Chamilo | 1 Chamilo | 2024-08-02 | 4.8 Medium |
| Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. | ||||