Chamilo
Page 2 of 2 — Chamilo CVEs from a corpus of 154, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37064 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section. |
CVE-2023-37063 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. |
CVE-2023-37062 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition. |
CVE-2023-37061 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. |
CVE-2023-34944 | Critical | 9.8 | 2023-06-13 | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via upl… |
CVE-2023-34962 | High | 8.1 | 2023-06-08 | Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes. |
CVE-2023-34961 | Medium | 6.1 | 2023-06-08 | Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field. |
CVE-2023-34959 | Medium | 5.3 | 2023-06-08 | An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on t… |
CVE-2023-34958 | Medium | 4.3 | 2023-06-08 | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if th… |
CVE-2023-31807 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes… |
CVE-2023-31806 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress fu… |
CVE-2023-31805 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function. |
CVE-2023-31804 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters. |
CVE-2023-31803 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters. |
CVE-2023-31802 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters. |
CVE-2023-31801 | Medium | 6.1 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. |
CVE-2023-31800 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter. |
CVE-2023-31799 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter. |
CVE-2022-42029 | High | 8.8 | 2022-10-17 | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/m… |
CVE-2022-40407 | High | 8.8 | 2022-09-29 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2022-27426 | High | 8.8 | 2022-04-15 | A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a cra… |
CVE-2022-27425 | Medium | 6.1 | 2022-04-15 | Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. |
CVE-2022-27423 | Critical | 9.8 | 2022-04-15 | Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php. |
CVE-2022-27422 | Medium | 6.1 | 2022-04-15 | A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction wit… |
CVE-2022-27421 | High | 7.2 | 2022-04-15 | Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. |
CVE-2021-40662 | High | 8.8 | 2022-03-21 | A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted U… |
CVE-2021-38745 | Medium | 6.8 | 2022-03-21 | Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin… |
CVE-2021-35415 | Medium | 4.8 | 2021-12-03 | A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Co… |
CVE-2021-35414 | Critical | 9.8 | 2021-12-03 | Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. |
CVE-2021-35413 | High | 8.8 | 2021-12-03 | A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via… |
CVE-2021-43687 | Medium | 6.1 | 2021-12-01 | chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the co… |
CVE-2020-23126 | Medium | 6.1 | 2021-11-03 | Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends. |
CVE-2021-37391 | Medium | 5.4 | 2021-08-10 | A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/… |
CVE-2021-37390 | Medium | 6.1 | 2021-08-10 | A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). |
CVE-2021-37389 | Medium | 6.1 | 2021-08-10 | Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. |
CVE-2021-34187 | Critical | 9.8 | 2021-06-28 | main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. |
CVE-2021-32925 | Medium | 6.5 | 2021-05-13 | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. |
CVE-2020-23128 | Medium | 4.9 | 2021-05-06 | Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit u… |
CVE-2020-23127 | High | 8.8 | 2021-05-06 | Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. |
CVE-2021-31933 | High | 7.2 | 2021-04-30 | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper f… |
CVE-2021-26746 | Medium | 6.1 | 2021-02-19 | Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. |
CVE-2012-4029 | Medium | 6.1 | 2020-02-08 | Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2013-0739 | Medium | 6.1 | 2020-01-30 | Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. |
CVE-2013-0738 | Medium | 6.1 | 2020-01-30 | Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. |
CVE-2012-4030 | High | 7.5 | 2020-01-10 | Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. |
CVE-2015-9540 | Medium | 6.1 | 2020-01-04 | Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503. |
CVE-2019-13082 | Critical | 9.8 | 2019-06-30 | Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking… |
CVE-2019-1000017 | Medium | 6.5 | 2019-02-04 | Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user… |
CVE-2019-1000015 | Medium | 6.1 | 2019-02-04 | Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data… |
CVE-2018-20329 | High | 8.1 | 2018-12-21 | Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (whi… |
CVE-2018-20328 | Medium | 5.4 | 2018-12-21 | Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under spec… |
CVE-2018-20327 | Medium | 5.4 | 2018-12-21 | Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to a… |
CVE-2018-1999019 | Critical | 9.8 | 2018-07-23 | Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can… |
CVE-2013-6787 | | 2013-12-05 | SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwor… |