CVE-2023-40629

SQLi vulnerability in LMS Lite component for Joomla...

Sql injection

SQLi vulnerability in LMS Lite component for Joomla...

CVE-2023-40629

The CVE-2023-40629 entry describes a SQL injection vulnerability in the Joomla LMS Lite component. Affected software: LMS Lite for Joomla (extension). Vulnerable element: the LMS Lite component code handling input likely reused in SQL queries; exact vulnerable file/parameter is not specified in t...

CVE-2023-40629 Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1

SQLi vulnerability in LMS Lite component for Joomla...

Joomla Security Breach

Joomla is an open source, cross-platform content management system CMS developed by Open Source Matters team using PHP and MySQL. A security vulnerability exists in Joomla that stems from an SQL injection vulnerability in the LMS Lite component...

PT-2023-27550 · Joomla · Lms Lite

Name of the Vulnerable Software and Affected Versions: LMS Lite component for Joomla affected versions not specified Description: The issue concerns a SQLi vulnerability in the LMS Lite component for Joomla. There is also mention of a Denial of Service DoS issue, but details are limited. No...

Tutor LMS < 2.3.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Tutor LMS Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49829 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1f03fa341046 Credits emad Required privilege Administrator...

Chamilo LMS 1.11.x < 1.11.22 Multiple Vulnerabilities

Chamilo LMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:chamilo:chamilolms"; if...

Chamilo LMS 1.11.x < 1.11.24 Multiple Vulnerabilities

Chamilo LMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:chamilo:chamilolms"; if...

CVE-2023-6359

A Cross-Site Scripting XSS vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localidad' parameter to inject a custom JavaScript payload and partially take over another user's browser session, due to the lack of proper sanitisation of the...

Cross site scripting

A Cross-Site Scripting XSS vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localidad' parameter to inject a custom JavaScript payload and partially take over another user's browser session, due to the lack of proper sanitisation of the...

CVE-2023-6359

CVE-2023-6359 — Alumne LMS suffers a Cross-Site Scripting (XSS) vulnerability in version 4.0.0.1.08 due to inadequate sanitization of the localidad parameter on the "/users/editmy" page. An attacker could inject a JavaScript payload via this field and partially take over another user’s browser se...

CVE-2023-6359 Cross-Site Scripting in Alumne LMS

A Cross-Site Scripting XSS vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localidad' parameter to inject a custom JavaScript payload and partially take over another user's browser session, due to the lack of proper sanitisation of the...

CVE-2023-4226

Unrestricted file upload in /main/inc/ajax/work.ajax.php in Chamilo LMS = v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files...

CVE-2023-4225

Unrestricted file upload in /main/inc/ajax/exercise.ajax.php in Chamilo LMS = v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files...

CVE-2023-4224

Unrestricted file upload in /main/inc/ajax/dropbox.ajax.php in Chamilo LMS = v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files...

CVE-2023-4223

Unrestricted file upload in /main/inc/ajax/document.ajax.php in Chamilo LMS = v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files...

CVE-2023-4222

Command injection in main/lp/openofficetextdocument.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...

CVE-2023-4220

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...