CVE-2024-30616

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity...

CVE-2024-30619

Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=getcountmessage" AND "/main/inc/ajax/online.ajax.php?a=getusersonline."...

CVE-2024-30618

A Stored Cross-Site Scripting XSS Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'grouptopics.php'...

PT-2024-23525

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.26 Description The issue is related to Incorrect Access Control, allowing a non-authenticated attacker to request sensitive information. Specifically, an attacker can access the number of messages and the number of...

CVE-2024-30619

Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=getcountmessage" AND "/main/inc/ajax/online.ajax.php?a=getusersonline."...

CVE-2024-30618

A Stored Cross-Site Scripting XSS Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'grouptopics.php'...

CVE-2024-30619

Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=getcountmessage" AND "/main/inc/ajax/online.ajax.php?a=getusersonline."...

CVE-2024-30616

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity...

CVE-2024-30617

A Cross-Site Request Forgery CSRF vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge...

CVE-2024-30617

A Cross-Site Request Forgery CSRF vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge...

CVE-2024-30617

A Cross-Site Request Forgery (CSRF) vulnerability exists in Chamilo LMS version 1.11.26 within the "/main/social/home.php" page. This flaw allows an attacker to initiate a request that posts fraudulent content to a user's social wall without their knowledge or consent. While a specific patch vers...

CVE-2024-30618

A Stored Cross-Site Scripting (XSS) vulnerability exists in Chamilo LMS 1.11.26 . A remote attacker can execute arbitrary JavaScript in a victim's web browser by submitting a malicious payload via the 'content' parameter in 'group_topics.php' . This vulnerability is caused by the improper neutral...

CVE-2024-30619: Undefined Security Weakness

Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=getcountmessage" AND "/main/inc/ajax/online.ajax.php?a=getusersonline."...

CVE-2024-30617

A Cross-Site Request Forgery CSRF vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge...

CVE-2024-30619

Chamilo LMS version 1.11.26 is vulnerable to Incorrect Access Control , allowing an unauthenticated attacker to request sensitive information. The vulnerability is triggered via the endpoints /main/inc/ajax/message.ajax.php?a=get_count_message and /main/inc/ajax/online.ajax.php?a=get_users_online...

CVE-2024-30616

Chamilo LMS version 1.11.26 is vulnerable to Incorrect Access Control via the main/auth/profile endpoint. This flaw allows non-admin users to manipulate sensitive profile information, which poses a significant risk to data integrity . To remediate this vulnerability, users are recommended to upda...

PT-2024-23523

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.26 Description A Cross-Site Request Forgery CSRF vulnerability in Chamilo LMS allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge. The...

CVE-2024-30616: Incorrect Authorization

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity...

CVE-2024-30618: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'grouptopics.php'...

CVE-2024-30617: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge...