CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/10/2025 |
| CVE-2025-11344 | CRITICO9.8 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addresses this issue. I | 06/10/2025 |
| CVE-2024-33529 | ALTO7.2 | ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types. | 21/05/2024 |
| CVE-2024-33528 | MEDIO4.7 | A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2024-33527 | MEDIO5.4 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2024-33526 | ALTO7.1 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2023-36486 | ALTO7.2 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename. | 25/12/2023 |
| CVE-2023-36485 | ALTO7.2 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file. | 25/12/2023 |
| CVE-2023-45869 | CRITICO9.0 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php | 26/10/2023 |
| CVE-2023-45868 | ALTO8.1 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside the documentRoot, | 26/10/2023 |
| CVE-2023-45867 | MEDIO6.5 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web | 26/10/2023 |
| CVE-2023-36484 | MEDIO6.1 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). | 29/06/2023 |
| CVE-2023-36488 | MEDIO5.4 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). | 29/06/2023 |
| CVE-2023-36487 | CRITICO9.8 | The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. | 29/06/2023 |
| CVE-2022-45918 | MEDIO6.5 | ILIAS before 7.16 allows External Control of File Name or Path. | 07/12/2022 |
| CVE-2022-45917 | MEDIO6.1 | ILIAS before 7.16 has an Open Redirect. | 07/12/2022 |
| CVE-2022-45916 | MEDIO5.4 | ILIAS before 7.16 allows XSS. | 07/12/2022 |
| CVE-2022-45915 | ALTO8.8 | ILIAS before 7.16 allows OS Command Injection. | 07/12/2022 |