CVE-2023-34960

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name...

Server side request forgery (ssrf)

An issue in Chamilo v1.11. up to v1.11.18 allows attackers to execute a Server-Side Request Forgery SSRF and obtain information on the services running on the server via crafted requests in the social and links tools...

Cross site scripting

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function...

CVE-2023-31807

CVE-2023-31807 affects Chamilo LMS up to v1.11.18. A cross-site scripting vulnerability in the Personal Notes feature can be triggered by a crafted payload, reportedly allowing a local attacker to execute arbitrary code. The available connected documents consistently describe the same issue but d...