Show filters
25 Total Results
Displaying 1-10 of 25
Sort by:
Attacker Value
Unknown
CVE-2012-5776
Disclosure Date: January 29, 2020 (last updated February 21, 2025)
Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
0
Attacker Value
Unknown
CVE-2014-1877
Disclosure Date: March 13, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.
0
Attacker Value
Unknown
CVE-2013-6341
Disclosure Date: December 05, 2013 (last updated October 05, 2023)
SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php.
0
Attacker Value
Unknown
CVE-2009-2005
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Cross-site request forgery (CSRF) vulnerability in Dokeos 1.8.5, and possibly earlier, allows remote attackers to hijack the authentication of unspecified victims and add new personal agenda items via unknown vectors.
0
Attacker Value
Unknown
CVE-2009-2006
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) search_term parameter to main/auth/courses.php; the (2) frm_title and (3) frm_content parameters in a new personal agenda item action; the (4) title and (5) tutor_name parameters in a new course action; and the (6) student and (7) course parameters to main/mySpace/myStudents.php. NOTE: vectors 2 and 3 might only be exploitable via a separate CSRF vulnerability.
0
Attacker Value
Unknown
CVE-2009-2008
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) uInfo parameter to main/tracking/userLog.php and the (2) course parameter to main/mySpace/lp_tracking.php, a different vector than CVE-2009-2006.2.
0
Attacker Value
Unknown
CVE-2009-2004
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in main/mySpace/myStudents.php in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) student and (2) course parameters, a different vector than CVE-2007-2902.
0
Attacker Value
Unknown
CVE-2009-2009
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) curdirpath parameter to main/document/slideshow.php and the (2) file parameter to main/exercice/testheaderpage.php.
0
Attacker Value
Unknown
CVE-2009-2007
Disclosure Date: June 08, 2009 (last updated October 04, 2023)
Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to (1) read portions of arbitrary files via a .. (dot dot) and a ..\ (dot dot backslash) in the lang parameter to main/exercice/hotspot_lang_conversion.php and (2) read arbitrary files via a .. (dot dot) in the doc_url parameter to main/exercice/Hpdownload.php.
0
Attacker Value
Unknown
CVE-2008-3363
Disclosure Date: July 30, 2008 (last updated October 04, 2023)
Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the include parameter.
0
