Vulnerabilities (CVE)

Filtered by vendor Chamilo Subscribe
Total 66 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-31803 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 4.8 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
CVE-2023-34959 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 5.3 MEDIUM
An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.
CVE-2023-34962 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 8.1 HIGH
Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.
CVE-2023-31804 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 5.4 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
CVE-2023-31801 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 6.1 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
CVE-2023-37062 1 Chamilo 1 Chamilo 2024-02-04 N/A 4.8 MEDIUM
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition.
CVE-2023-37064 1 Chamilo 1 Chamilo 2024-02-04 N/A 4.8 MEDIUM
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section.
CVE-2023-31806 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 5.4 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
CVE-2023-31805 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 4.8 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
CVE-2023-37063 1 Chamilo 1 Chamilo 2024-02-04 N/A 4.8 MEDIUM
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section.
CVE-2023-31800 1 Chamilo 1 Chamilo Lms 2024-02-04 N/A 5.4 MEDIUM
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVE-2022-42029 1 Chamilo 1 Chamilo 2024-02-04 N/A 8.8 HIGH
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory.
CVE-2021-40662 1 Chamilo 1 Chamilo 2024-02-04 6.8 MEDIUM 8.8 HIGH
A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.
CVE-2022-27421 1 Chamilo 1 Chamilo Lms 2024-02-04 6.5 MEDIUM 7.2 HIGH
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
CVE-2022-27423 1 Chamilo 1 Chamilo Lms 2024-02-04 7.5 HIGH 9.8 CRITICAL
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.
CVE-2022-27426 1 Chamilo 1 Chamilo Lms 2024-02-04 6.5 MEDIUM 8.8 HIGH
A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.
CVE-2021-38745 1 Chamilo 1 Chamilo 2024-02-04 4.6 MEDIUM 6.8 MEDIUM
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.
CVE-2022-27425 1 Chamilo 1 Chamilo 2024-02-04 4.3 MEDIUM 6.1 MEDIUM
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
CVE-2022-27422 1 Chamilo 1 Chamilo Lms 2024-02-04 4.3 MEDIUM 6.1 MEDIUM
A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
CVE-2021-35415 1 Chamilo 1 Chamilo Lms 2024-02-04 3.5 LOW 4.8 MEDIUM
A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields.