CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

Cross site request forgery (csrf)

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

Privilege escalation

Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...

Chamilo LMS 跨站请求伪造漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. A cross-site request forgery vulnerability exists in Chamilo LMS version...

Chamilo LMS 安全漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. An authorization issue vulnerability exists in Chamilo LMS version 1.11.10,...

CVE-2020-23128

Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...

CVE-2020-23128

Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...

CVE-2020-23128

CVE-2020-23128 affects Chamilo LMS 1.11.10. The issue is improper privilege management: a user with Sessions administrator privileges can create a new user and then use the Edit User function to grant that user administrator privileges. The connected sources consistently describe this as a privil...

CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2020-23127

CVE-2020-23127 affects Chamilo LMS 1.11.10 with a Cross-Site Request Forgery (CSRF) via the edit_user function targeting an administrator. Connected sources indicate the root cause is insufficient validation of trusted requests in the web application. Reported impact is enabling unauthorized acti...

CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2020-23127: Cross-Site Request Forgery (CSRF)

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

PT-2021-10839

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10 Description The issue is related to Cross Site Request Forgery CSRF via the edit user function, which can be exploited by targeting an admin user. This allows for unauthorized actions to be performed on behalf of th...

CVE-2020-23128: Improper Privilege Management

Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...

PT-2021-10840

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10 Description The issue is related to improper privilege management. A user with Sessions administrator privilege can create a new user and then use the edit user function to change this new user to administrator...

CVE-2021-24242

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file...

CVE-2021-24242

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file...

CVE-2021-24242

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file...

CVE-2021-24242 Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file...

CVE-2021-24242

Affected software: Tutor LMS WordPress plugin (pre-1.8.8). Vulnerability: Local File Inclusion via a maliciously crafted sub_page parameter in the Tools page. Impact: High-privilege users can include arbitrary local PHP files (confidentiality/integrity concerns for the site). Root cause: Improper...