Chamilo / Chamilo
27 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2023-4225 | Chamilo LMS File Upload Functionality Remote Code Execution | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4226 | Chamilo LMS File Upload Functionality Remote Code Execution | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4224 | Chamilo LMS File Upload Functionality Remote Code Execution | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4223 | Chamilo LMS File Upload Functionality Remote Code Execution | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4222 | Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4221 | Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability | HIGH | 8.8 | Nov 28, 2023 |
| CVE-2023-4220 | Chamilo LMS Unauthenticated Big Upload File Remote Code Execution | HIGH | 8.1 | Nov 28, 2023 |
| CVE-2023-3545 | Chamilo LMS Htaccess File Upload Security Bypass | CRITICAL | 9.8 | Nov 28, 2023 |
| CVE-2023-3533 | Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write | CRITICAL | 9.8 | Nov 28, 2023 |
| CVE-2023-3368 | Chamilo LMS Unauthenticated Command Injection | CRITICAL | 9.8 | Nov 28, 2023 |
| CVE-2023-39061 | Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. | LOW | 3.5 | Aug 21, 2023 |
| CVE-2023-34960 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API… | CRITICAL | 9.8 | Aug 1, 2023 |
| CVE-2023-37067 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37066 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37065 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37064 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37063 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37062 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2023-37061 | Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. | MEDIUM | 4.8 | Jul 7, 2023 |
| CVE-2022-42029 | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/m… | HIGH | 8.8 | Oct 17, 2022 |
| CVE-2022-40407 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. | HIGH | 8.8 | Sep 29, 2022 |
| CVE-2022-27425 | Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. | MEDIUM | 6.1 | Apr 15, 2022 |
| CVE-2021-40662 | rhacm: A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands | HIGH | 8.8 | Mar 21, 2022 |
| CVE-2021-38745 | Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin.… | MEDIUM | 6.8 | Mar 21, 2022 |
| CVE-2021-43687 | chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the co… | MEDIUM | 6.1 | Dec 1, 2021 |
Showing 1 to 25 of 27 CVEs