Ilias Ilias
42 CVEs affecting Ilias Ilias. Latest disclosed: 2026-01-28. Critical: 2, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36487 | Critical | 9.8 | 2023-06-29 | The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. |
CVE-2023-45869 | Critical | 9.0 | 2023-10-26 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS… |
CVE-2022-45915 | High | 8.8 | 2022-12-07 | ILIAS before 7.16 allows OS Command Injection. |
CVE-2020-23996 | High | 8.8 | 2021-05-13 | A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of p… |
CVE-2020-25268 | High | 8.8 | 2020-11-10 | Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. |
CVE-2023-45868 | High | 8.1 | 2023-10-26 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on c… |
CVE-2024-33529 | High | 7.2 | 2024-05-21 | ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating syste… |
CVE-2023-36486 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-36485 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2024-33526 | High | 7.1 | 2024-05-21 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 al… |
CVE-2023-45867 | Medium | 6.5 | 2023-10-26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a pri… |
CVE-2022-45918 | Medium | 6.5 | 2022-12-07 | ILIAS before 7.16 allows External Control of File Name or Path. |
CVE-2020-23995 | Medium | 6.5 | 2021-05-13 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspac… |
CVE-2025-11346 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation… |
CVE-2025-11344 | Medium | 6.3 | 2025-10-06 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Hand… |
CVE-2023-36484 | Medium | 6.1 | 2023-06-29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). |
CVE-2022-45917 | Medium | 6.1 | 2022-12-07 | ILIAS before 7.16 has an Open Redirect. |
CVE-2019-1010237 | Medium | 6.1 | 2019-07-22 | Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code… |
CVE-2018-10428 | Medium | 6.1 | 2018-05-23 | ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected… |
CVE-2018-10307 | Medium | 6.1 | 2018-05-18 | error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. |