CVE-2022-27421

Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...

CVE-2022-27422

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

CVE-2022-27422

Chamilo LMS v1.11.13 is affected by a reflected cross-site scripting (XSS) vulnerability that enables attackers to run arbitrary web scripts or HTML when a user interacts with a crafted URL. According to the sources, the issue arises from user interaction with specially crafted input, enabling sc...

CVE-2022-27421

CVE-2022-27421 affects Chamilo LMS v1.11.13. The issue is a lack of validation on the user modification form, which allows an attacker to escalate privileges to Platform Admin. Affected component is the user modification flow; root cause is insufficient input validation. Impact per sources: privi...

CVE-2022-27421

Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...

CVE-2022-27421

Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...

CVE-2022-27422

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

PT-2022-18417

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description The issue is a SQL injection vulnerability. It can be exploited via the blog id parameter at the "/blog/blog.php" API endpoint. Recommendations For Chamilo LMS version 1.11.13, avoid using the blog id...

PT-2022-18420

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A zero-code remote code injection issue allows attackers to upload arbitrary code in the form of a new plugin via configuration.php. Recommendations For version 1.11.13, consider restricting access to th...

PT-2022-18418

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A cross-site scripting XSS issue was found in the /blog/blog.php component. This allows for potential malicious script execution. Recommendations For Chamilo LMS version 1.11.13, consider disabling acces...

PT-2022-18416

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A reflected cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL. This can occur when a user clicks on a specially designed lin...

PT-2022-18419

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A Server-Side Request Forgery SSRF issue allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file. Recommendations For Chamilo LMS version 1.11.13,...

CVE-2022-27426: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...

CVE-2022-27425: Improper Neutralization of Input During Web Page Generation

Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...

CVE-2022-27423: Improper Neutralization of Special Elements used in an SQL Command

Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...

CVE-2022-27421: Improper Input Validation

Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...

CVE-2022-27422: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

Chamilo LMS SQL注入漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, remote training and online question answering, etc. Chamilo LMS v1.11.13 is vulnerable to SQL injection, and no detailed vulnerability...

Chamilo LMS Cross-Site Request Forgery Vulnerability (CNVD-2022-33811)

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. Chamilo LMS version 1.11.14 is vulnerable to cross-site request forgery, which can be exploited by attackers to execute arbitrary commands on the victim host via user interaction with specially...

Chamilo LMS Code Injection Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. Chamilo LMS version 1.11.14 contains a code injection vulnerability that could be exploited by attackers to execute arbitrary code via a specially crafted plug-in...