CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/10/2025 |
| CVE-2025-11344 | 严重9.8 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addresses this issue. I | 06/10/2025 |
| CVE-2024-33529 | 高危7.2 | ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types. | 21/05/2024 |
| CVE-2024-33528 | 中危4.7 | A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2024-33527 | 中危5.4 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2024-33526 | 高危7.1 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | 21/05/2024 |
| CVE-2023-36486 | 高危7.2 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename. | 25/12/2023 |
| CVE-2023-36485 | 高危7.2 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file. | 25/12/2023 |
| CVE-2023-45869 | 严重9.0 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php | 26/10/2023 |
| CVE-2023-45868 | 高危8.1 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside the documentRoot, | 26/10/2023 |
| CVE-2023-45867 | 中危6.5 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web | 26/10/2023 |
| CVE-2023-36484 | 中危6.1 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). | 29/06/2023 |
| CVE-2023-36488 | 中危5.4 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). | 29/06/2023 |
| CVE-2023-36487 | 严重9.8 | The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. | 29/06/2023 |
| CVE-2022-45918 | 中危6.5 | ILIAS before 7.16 allows External Control of File Name or Path. | 07/12/2022 |
| CVE-2022-45917 | 中危6.1 | ILIAS before 7.16 has an Open Redirect. | 07/12/2022 |
| CVE-2022-45916 | 中危5.4 | ILIAS before 7.16 allows XSS. | 07/12/2022 |
| CVE-2022-45915 | 高危8.8 | ILIAS before 7.16 allows OS Command Injection. | 07/12/2022 |