Chamilo

12 results · Feed

• High 8.8
  CVE-2023-4225

  Chamilo LMS File Upload Functionality Remote Code Execution

  Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

  chamilo Chamilo
  Nov 28, 2023
• High 8.8
  CVE-2023-4226 Public exploit

  Chamilo LMS File Upload Functionality Remote Code Execution

  Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

  chamilo Chamilo
  Nov 28, 2023
• High 8.8
  CVE-2023-4224

  Chamilo LMS File Upload Functionality Remote Code Execution

  Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

  chamilo Chamilo
  Nov 28, 2023
• High 8.8
  CVE-2023-4223

  Chamilo LMS File Upload Functionality Remote Code Execution

  Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

  chamilo Chamilo
  Nov 28, 2023
• High 7.2
  CVE-2023-4222

  Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

  Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.

  chamilo Chamilo
  Nov 28, 2023
• High 7.2
  CVE-2023-4221

  Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

  Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.

  chamilo Chamilo
  Nov 28, 2023
• High 8.1
  CVE-2023-4220 Public exploit EPSS 76%

  Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

  Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via…

  chamilo Chamilo
  Nov 28, 2023
• Critical 9.8
  CVE-2023-3545

  Chamilo LMS Htaccess File Upload Security Bypass

  Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess`…

  chamilo Chamilo
  Nov 28, 2023
• Critical 9.8
  CVE-2023-3533

  Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write

  Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

  chamilo Chamilo
  Nov 28, 2023
• Critical 9.8
  CVE-2023-3368 EPSS 70%

  Chamilo LMS Unauthenticated Command Injection

  Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.

  chamilo Chamilo
  Nov 28, 2023
• Unscored —
  CVE-2013-0739

  Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.

  chamilo Chamilo
  Jan 30, 2020
• Unscored —
  CVE-2013-0738

  Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.

  chamilo Chamilo
  Jan 30, 2020