Ilias
by Ilias
Source repositories
CVEs (44)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10428 | Med | 0.33 | 6.1 | 0.02 | May 23, 2018 | ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting. | ||
| CVE-2024-33528 | Med | 0.31 | 4.7 | 0.00 | May 21, 2024 | A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. | ||
| CVE-2024-33525 | Med | 0.28 | 4.3 | 0.01 | May 21, 2024 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS 7.20 to 7.29 and ILIAS 8.4 to 8.10 as well as ILIAS 9.0 allows remote authenticated attackers with administrative privileges to inject… | ||
| CVE-2022-31266 | Med | 0.28 | 4.3 | 0.01 | Jun 29, 2022 | In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. | ||
| CVE-2022-31478 | Med | 0.28 | 4.3 | 0.01 | Jun 21, 2022 | The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function. | ||
| CVE-2020-36944 | Med | 0.26 | 4.0 | 0.00 | Jan 28, 2026 | ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the… | ||
| CVE-2018-5688 | Med | 0.03 | 6.1 | 0.03 | Jan 14, 2018 | ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component. | ||
| CVE-2014-2090 | 0.03 | — | 0.01 | Mar 2, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. | |||
| CVE-2014-2089 | 0.03 | — | 0.03 | Mar 2, 2014 | ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname. | |||
| CVE-2014-2088 | 0.03 | — | 0.03 | Mar 2, 2014 | Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain… | |||
| CVE-2008-5816 | 0.03 | — | 0.01 | Jan 2, 2009 | SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter. | |||
| CVE-2023-36486 | Hig | 0.00 | 7.2 | 0.01 | Dec 25, 2023 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename. | ||
| CVE-2023-36485 | Hig | 0.00 | 7.2 | 0.01 | Dec 25, 2023 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file. | ||
| CVE-2020-23996 | Hig | 0.00 | 8.8 | 0.02 | May 13, 2021 | A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data. | ||
| CVE-2020-23995 | Med | 0.00 | 6.5 | 0.02 | May 13, 2021 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload. | ||
| CVE-2019-1010237 | Med | 0.00 | 6.1 | 0.02 | Jul 22, 2019 | Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap… | ||
| CVE-2018-10307 | Med | 0.00 | 6.1 | 0.01 | May 18, 2018 | error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. | ||
| CVE-2018-10306 | Med | 0.00 | 6.1 | 0.01 | May 18, 2018 | Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date. | ||
| CVE-2018-11120 | Med | 0.00 | 6.1 | 0.01 | May 17, 2018 | Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. | ||
| CVE-2018-11119 | Med | 0.00 | 6.1 | 0.01 | May 17, 2018 | ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. |
- risk 0.33cvss 6.1epss 0.02
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
- risk 0.31cvss 4.7epss 0.00
A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload.
- risk 0.28cvss 4.3epss 0.01
A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS 7.20 to 7.29 and ILIAS 8.4 to 8.10 as well as ILIAS 9.0 allows remote authenticated attackers with administrative privileges to inject…
- risk 0.28cvss 4.3epss 0.01
In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.
- risk 0.28cvss 4.3epss 0.01
The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.
- risk 0.26cvss 4.0epss 0.00
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the…
- risk 0.03cvss 6.1epss 0.03
ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component.
- CVE-2014-2090Mar 2, 2014risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter.
- CVE-2014-2089Mar 2, 2014risk 0.03cvss —epss 0.03
ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.
- CVE-2014-2088Mar 2, 2014risk 0.03cvss —epss 0.03
Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain…
- CVE-2008-5816Jan 2, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter.
- risk 0.00cvss 7.2epss 0.01
The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.
- risk 0.00cvss 7.2epss 0.01
The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.
- risk 0.00cvss 8.8epss 0.02
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.
- risk 0.00cvss 6.5epss 0.02
An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
- risk 0.00cvss 6.1epss 0.02
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap…
- risk 0.00cvss 6.1epss 0.01
error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
- risk 0.00cvss 6.1epss 0.01
Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date.
- risk 0.00cvss 6.1epss 0.01
Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.
- risk 0.00cvss 6.1epss 0.01
ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter.
Page 2 of 3