CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. |
| 03/12/2021 |
| CVE-2021-43687 | 보통6.1 | chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie. | 01/12/2021 |
| CVE-2020-23126 | 보통6.1 | Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends. | 03/11/2021 |
| CVE-2021-37391 | 보통5.4 | A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitati | 10/08/2021 |
| CVE-2021-37390 | 보통6.1 | A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). | 10/08/2021 |
| CVE-2021-37389 | 보통6.1 | Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. | 10/08/2021 |
| CVE-2021-34187 | 심각9.8 | main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. | 28/06/2021 |
| CVE-2021-32925 | 보통6.5 | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. | 13/05/2021 |
| CVE-2020-23128 | 보통4.9 | Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege. | 06/05/2021 |
| CVE-2020-23127 | 높음8.8 | Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. | 06/05/2021 |
| CVE-2021-31933 | 높음7.2 | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code | 30/04/2021 |
| CVE-2021-26746 | 보통6.1 | Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. | 19/02/2021 |
| CVE-2012-4029 | 보통6.1 | Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action. | 08/02/2020 |
| CVE-2013-0739 | 보통6.1 | Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. | 30/01/2020 |
| CVE-2013-0738 | 보통6.1 | Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. | 30/01/2020 |
| CVE-2012-4030 | 높음7.5 | Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. | 10/01/2020 |
| CVE-2015-9540 | 보통6.1 | Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503. | 04/01/2020 |