5238 matches found
CVE-2022-27425
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...
CVE-2022-27425
CVE-2022-27425 affects Chamilo LMS v1.11.13. The vulnerability is a cross-site scripting (XSS) flaw in the /blog/blog.php component. Public records (NVD, Red Hat, CNVD, OSV, CVE list) consistently describe the issue as XSS, with no details on exploit code or in‑the‑wild activity in the provided d...
CVE-2022-27425
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...
CVE-2022-27423
CVE-2022-27423 affects Chamilo LMS v1.11.13, exposing a SQL injection vulnerability via the blog_id parameter in /blog/blog.php. Public sources in the connected set confirm an injection flaw without detailing exploit vectors. The NVD entry lists CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base ...
CVE-2022-27423
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...
CVE-2022-27423
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...
CVE-2022-27421
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
CVE-2022-27422
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2022-27421
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
CVE-2022-27421
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
CVE-2022-27421
CVE-2022-27421 affects Chamilo LMS v1.11.13. The issue is a lack of validation on the user modification form, which allows an attacker to escalate privileges to Platform Admin. Affected component is the user modification flow; root cause is insufficient input validation. Impact per sources: privi...
CVE-2022-27422
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2022-27422
Chamilo LMS v1.11.13 is affected by a reflected cross-site scripting (XSS) vulnerability that enables attackers to run arbitrary web scripts or HTML when a user interacts with a crafted URL. According to the sources, the issue arises from user interaction with specially crafted input, enabling sc...
CVE-2022-27422: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2022-27426: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file...
PT-2022-18419
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A Server-Side Request Forgery SSRF issue allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file. Recommendations For Chamilo LMS version 1.11.13,...
PT-2022-18420
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A zero-code remote code injection issue allows attackers to upload arbitrary code in the form of a new plugin via configuration.php. Recommendations For version 1.11.13, consider restricting access to th...
CVE-2022-27421: Improper Input Validation
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...
PT-2022-18417
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description The issue is a SQL injection vulnerability. It can be exploited via the blog id parameter at the "/blog/blog.php" API endpoint. Recommendations For Chamilo LMS version 1.11.13, avoid using the blog id...
CVE-2022-27425: Improper Neutralization of Input During Web Page Generation
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting XSS vulnerability via the component /blog/blog.php...