CVE-2026-12789 | Medium | 4.7 | 2026-06-21 | A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS… |
CVE-2020-36944 | Medium | 4.0 | 2026-01-28 | ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF expor… |
CVE-2025-11346 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation… |
CVE-2025-11345 | Medium | 5.5 | 2025-10-06 | A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes… |
CVE-2025-11344 | Medium | 6.3 | 2025-10-06 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Hand… |
CVE-2024-33529 | High | 7.2 | 2024-05-21 | ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating syste… |
CVE-2024-33528 | Medium | 4.7 | 2024-05-21 | A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to… |
CVE-2024-33527 | Medium | 5.4 | 2024-05-21 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows… |
CVE-2024-33526 | High | 7.1 | 2024-05-21 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 al… |
CVE-2023-36486 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-36485 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-45869 | Critical | 9.0 | 2023-10-26 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS… |
CVE-2023-45868 | High | 8.1 | 2023-10-26 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on c… |
CVE-2023-45867 | Medium | 6.5 | 2023-10-26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a pri… |
CVE-2023-36484 | Medium | 6.1 | 2023-06-29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). |
CVE-2023-36488 | Medium | 5.4 | 2023-06-29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). |
CVE-2023-36487 | Critical | 9.8 | 2023-06-29 | The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. |
CVE-2022-45918 | Medium | 6.5 | 2022-12-07 | ILIAS before 7.16 allows External Control of File Name or Path. |
CVE-2022-45917 | Medium | 6.1 | 2022-12-07 | ILIAS before 7.16 has an Open Redirect. |
CVE-2022-45916 | Medium | 5.4 | 2022-12-07 | ILIAS before 7.16 allows XSS. |
CVE-2022-45915 | High | 8.8 | 2022-12-07 | ILIAS before 7.16 allows OS Command Injection. |
CVE-2022-31266 | Medium | 4.3 | 2022-06-29 | In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. |
CVE-2020-23996 | High | 8.8 | 2021-05-13 | A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of p… |
CVE-2020-23995 | Medium | 6.5 | 2021-05-13 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspac… |
CVE-2020-25268 | High | 8.8 | 2020-11-10 | Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. |
CVE-2020-25267 | Medium | 5.4 | 2020-11-10 | An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4. |
CVE-2019-1010237 | Medium | 6.1 | 2019-07-22 | Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code… |
CVE-2018-10428 | Medium | 6.1 | 2018-05-23 | ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected… |
CVE-2018-10307 | Medium | 6.1 | 2018-05-18 | error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. |
CVE-2018-10306 | Medium | 6.1 | 2018-05-18 | Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow X… |
CVE-2018-11120 | Medium | 6.1 | 2018-05-17 | Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. |
CVE-2018-11119 | Medium | 6.1 | 2018-05-17 | ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. |
CVE-2018-11118 | Medium | 6.1 | 2018-05-17 | The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. |
CVE-2018-11117 | Medium | 6.1 | 2018-05-17 | Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. |
CVE-2018-10665 | Medium | 6.1 | 2018-05-02 | ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. |
CVE-2018-5688 | Medium | 6.1 | 2018-01-14 | ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component. |
CVE-2017-15538 | Medium | 5.4 | 2017-10-17 | Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain… |
CVE-2017-7583 | Medium | 6.1 | 2017-04-07 | ILIAS before 5.2.3 has XSS via SVG documents. |
CVE-2014-2090 | | | 2014-03-02 | Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the… |
CVE-2014-2089 | | | 2014-03-02 | ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathn… |
CVE-2014-2088 | | | 2014-03-02 | Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in… |
CVE-2008-5816 | | | 2009-01-02 | SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter. |
CVE-2007-5806 | | | 2007-11-05 | Cross-site scripting (XSS) vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary… |