Chamilo Lms
by Chamilo
Source repositories
CVEs (145)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-37065 | 0.00 | — | 0.00 | Jul 7, 2023 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section. | |||
| CVE-2023-37061 | 0.00 | — | 0.00 | Jul 7, 2023 | Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. | |||
| CVE-2023-37066 | 0.00 | — | 0.00 | Jul 7, 2023 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel. | |||
| CVE-2023-34944 | 0.00 | — | 0.01 | Jun 13, 2023 | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file. | |||
| CVE-2023-34961 | 0.00 | — | 0.00 | Jun 8, 2023 | Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field. | |||
| CVE-2023-34958 | 0.00 | — | 0.00 | Jun 8, 2023 | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID. | |||
| CVE-2023-34959 | 0.00 | — | 0.01 | Jun 8, 2023 | An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools. | |||
| CVE-2023-34962 | 0.00 | — | 0.01 | Jun 8, 2023 | Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes. | |||
| CVE-2023-31805 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function. | |||
| CVE-2023-31807 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function. | |||
| CVE-2023-31800 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter. | |||
| CVE-2023-31801 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. | |||
| CVE-2023-31802 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters. | |||
| CVE-2023-31804 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters. | |||
| CVE-2023-31806 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function. | |||
| CVE-2023-31803 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters. | |||
| CVE-2023-31799 | 0.00 | — | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter. | |||
| CVE-2022-42029 | 0.00 | — | 0.01 | Oct 17, 2022 | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory. | |||
| CVE-2022-40407 | 0.00 | — | 0.01 | Sep 29, 2022 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. | |||
| CVE-2022-27425 | 0.00 | — | 0.01 | Apr 15, 2022 | Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. |
- CVE-2023-37065Jul 7, 2023risk 0.00cvss —epss 0.00
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section.
- CVE-2023-37061Jul 7, 2023risk 0.00cvss —epss 0.00
Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section.
- CVE-2023-37066Jul 7, 2023risk 0.00cvss —epss 0.00
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.
- CVE-2023-34944Jun 13, 2023risk 0.00cvss —epss 0.01
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- CVE-2023-34961Jun 8, 2023risk 0.00cvss —epss 0.00
Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
- CVE-2023-34958Jun 8, 2023risk 0.00cvss —epss 0.00
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.
- CVE-2023-34959Jun 8, 2023risk 0.00cvss —epss 0.01
An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.
- CVE-2023-34962Jun 8, 2023risk 0.00cvss —epss 0.01
Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.
- CVE-2023-31805May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
- CVE-2023-31807May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
- CVE-2023-31800May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
- CVE-2023-31801May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
- CVE-2023-31802May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
- CVE-2023-31804May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
- CVE-2023-31806May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
- CVE-2023-31803May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
- CVE-2023-31799May 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
- CVE-2022-42029Oct 17, 2022risk 0.00cvss —epss 0.01
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory.
- CVE-2022-40407Sep 29, 2022risk 0.00cvss —epss 0.01
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
- CVE-2022-27425Apr 15, 2022risk 0.00cvss —epss 0.01
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
Page 6 of 8