ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...

Design/Logic Flaw

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

CVE-2018-10665

CVE-2018-10665 : A cross-site scripting (XSS) vulnerability affects ILIAS 5.3.4, caused by unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. Multiple connected sources (Red Hat, CNVD, NVD, OSV, CVE lists) confirm the issue as an XSS in ILIAS 5.3.4. The provide...

CVE-2018-10665: Improper Neutralization of Input During Web Page Generation

ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...

ILIAS 5.3.4 XSS Vulnerability

ILIAS eLearning version 5.3.4 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...