1843 matches found
CVE-2020-23128
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...
CVE-2020-23127
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...
CVE-2020-23127
CVE-2020-23127 affects Chamilo LMS 1.11.10 with a Cross-Site Request Forgery (CSRF) via the edit_user function targeting an administrator. Connected sources indicate the root cause is insufficient validation of trusted requests in the web application. Reported impact is enabling unauthorized acti...
CVE-2020-23127
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...
CVE-2020-23127: Cross-Site Request Forgery (CSRF)
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...
PT-2021-10839
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10 Description The issue is related to Cross Site Request Forgery CSRF via the edit user function, which can be exploited by targeting an admin user. This allows for unauthorized actions to be performed on behalf of th...
CVE-2020-23128: Improper Privilege Management
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...
PT-2021-10840
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10 Description The issue is related to improper privilege management. A user with Sessions administrator privilege can create a new user and then use the edit user function to change this new user to administrator...
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
Remote code execution
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
CVE-2021-31933
Chamilo LMS up to version 1.11.14 is affected by CVE-2021-31933 due to improper input sanitization for a file-upload parameter and inadequate file-extension filtering (e.g., .phar/.pht). This allows a remote authenticated administrator to upload a file containing PHP code via main/inc/lib/fileUpl...
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
CVE-2021-31933: Use of Incorrectly-Resolved Name or Reference
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames e.g., .phar or .pht. A remote authenticated administrator is able to upload a file containin...
Chamilo 输入验证错误漏洞
Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo version 1.11.14 and prior versions...
PT-2021-19606
Name of the Vulnerable Software and Affected Versions: Chamilo versions prior to 1.11.14 Description: A remote code execution issue exists due to improper input sanitization of a parameter used for file uploads and improper file-extension filtering for certain filenames, such as .phar or .pht. A...
Chamilo Cross-Site Scripting Vulnerability
Chamilo is a learning management system focused on ease of use and accessibility. A cross-site scripting vulnerability exists in Chamilo 1.11.14. An attacker can exploit this vulnerability via main/calendar/agendalist.php?type= URI to conduct cross-site scripting attacks...