829 matches found
Design/Logic Flaw
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
Server side request forgery (ssrf)
A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...
Cross site scripting
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
Sql injection
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...
CVE-2022-27426
CVE-2022-27426 describes a Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 . Attackers can enumerate internal networks and execute arbitrary system commands through a crafted Phar file. The NVD CVSS vectors indicate a high impact (CVSSv3.1: 8.8, HIGH; network attack, low complexity, no...
CVE-2022-27426
A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...
CVE-2022-27426
A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...
CVE-2022-27425
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...
CVE-2022-27425
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...
CVE-2022-27425
CVE-2022-27425 affects Chamilo LMS v1.11.13. The vulnerability is a cross-site scripting (XSS) flaw in the /blog/blog.php component. Public records (NVD, Red Hat, CNVD, OSV, CVE list) consistently describe the issue as XSS, with no details on exploit code or in‑the‑wild activity in the provided d...
CVE-2022-27423
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...
CVE-2022-27423
CVE-2022-27423 affects Chamilo LMS v1.11.13, exposing a SQL injection vulnerability via the blog_id parameter in /blog/blog.php. Public sources in the connected set confirm an injection flaw without detailing exploit vectors. The NVD entry lists CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base ...
CVE-2022-27423
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...
CVE-2022-27422
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2022-27421
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
CVE-2022-27422
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2022-27421
CVE-2022-27421 affects Chamilo LMS v1.11.13. The issue is a lack of validation on the user modification form, which allows an attacker to escalate privileges to Platform Admin. Affected component is the user modification flow; root cause is insufficient input validation. Impact per sources: privi...
CVE-2022-27422
Chamilo LMS v1.11.13 is affected by a reflected cross-site scripting (XSS) vulnerability that enables attackers to run arbitrary web scripts or HTML when a user interacts with a crafted URL. According to the sources, the issue arises from user interaction with specially crafted input, enabling sc...