SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions...
4.9CVSS
5.5AI Score
0.001EPSS
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG...
9.8CVSS
9.5AI Score
0.001EPSS
Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal...
8.1CVSS
7.9AI Score
0.001EPSS
An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links...
5.3CVSS
5.5AI Score
0.001EPSS
Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment...
6.1CVSS
6AI Score
0.001EPSS
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's...
4.3CVSS
4.7AI Score
0.0004EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage...
4.8CVSS
5.3AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress...
5.4CVSS
5.6AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes...
5.4CVSS
5.6AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel...
6.1CVSS
6.3AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url...
5.4CVSS
5.7AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category...
5.4CVSS
5.7AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title...
5.4CVSS
5.7AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing...
4.8CVSS
5.4AI Score
0.001EPSS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements...
4.8CVSS
5.4AI Score
0.001EPSS
A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar...
8.8CVSS
8.8AI Score
0.001EPSS
A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted...
6.1CVSS
5.9AI Score
0.001EPSS
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform...
7.2CVSS
7.1AI Score
0.001EPSS
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at...
9.8CVSS
9.8AI Score
0.001EPSS
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess...
8.8CVSS
8.8AI Score
0.012EPSS
Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in...
9.8CVSS
9.8AI Score
0.007EPSS
A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content"...
4.8CVSS
4.8AI Score
0.001EPSS
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network...
6.1CVSS
6.5AI Score
0.001EPSS
A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search...
6.1CVSS
6AI Score
0.001EPSS
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...
5.4CVSS
5.6AI Score
0.001EPSS
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin...
8.8CVSS
7.6AI Score
0.001EPSS
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator...
4.9CVSS
7.3AI Score
0.001EPSS