Show filters
71 Total Results
Displaying 41-50 of 71
Sort by:
Attacker Value
Unknown
CVE-2022-27421
Disclosure Date: April 15, 2022 (last updated February 23, 2025)
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
0
Attacker Value
Unknown
CVE-2021-40662
Disclosure Date: March 21, 2022 (last updated February 23, 2025)
A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.
0
Attacker Value
Unknown
CVE-2021-38745
Disclosure Date: March 21, 2022 (last updated February 23, 2025)
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.
0
Attacker Value
Unknown
CVE-2021-35415
Disclosure Date: December 03, 2021 (last updated February 23, 2025)
A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields.
0
Attacker Value
Unknown
CVE-2021-35414
Disclosure Date: December 03, 2021 (last updated February 23, 2025)
Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.
0
Attacker Value
Unknown
CVE-2021-35413
Disclosure Date: December 03, 2021 (last updated February 23, 2025)
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.
0
Attacker Value
Unknown
CVE-2021-43687
Disclosure Date: December 01, 2021 (last updated February 23, 2025)
chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.
0
Attacker Value
Unknown
CVE-2020-23126
Disclosure Date: November 03, 2021 (last updated February 23, 2025)
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.
0
Attacker Value
Unknown
CVE-2021-37389
Disclosure Date: August 10, 2021 (last updated February 23, 2025)
Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter.
0
Attacker Value
Unknown
CVE-2021-37391
Disclosure Date: August 10, 2021 (last updated February 23, 2025)
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
0
