Vulnerabilities > Chamilo

DATE CVE VULNERABILITY TITLE RISK
2022-04-15 CVE-2022-27421 Improper Privilege Management vulnerability in Chamilo LMS 1.11.14/1.11.16
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
network
low complexity
chamilo CWE-269
6.5
2022-04-15 CVE-2022-27422 Cross-site Scripting vulnerability in Chamilo LMS
A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
network
chamilo CWE-79
4.3
2022-04-15 CVE-2022-27423 SQL Injection vulnerability in Chamilo LMS
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.
network
low complexity
chamilo CWE-89
7.5
2022-04-15 CVE-2022-27425 Cross-site Scripting vulnerability in Chamilo
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
network
chamilo CWE-79
4.3
2022-04-15 CVE-2022-27426 Server-Side Request Forgery (SSRF) vulnerability in Chamilo LMS
A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.
network
low complexity
chamilo CWE-918
6.5
2022-04-15 CVE-2022-27427 Code Injection vulnerability in Chamilo LMS 1.11.14/1.11.16
A zero-code remote code injection vulnerability via configuration.php in Chamilo LMS v1.11.13 allows attackers to upload arbitrary code in the form of a new plugin.
network
high complexity
chamilo CWE-94
4.6
2022-03-21 CVE-2021-38745 Code Injection vulnerability in Chamilo 1.11.14
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin.
network
high complexity
chamilo CWE-94
4.6
2022-03-21 CVE-2021-40662 Cross-Site Request Forgery (CSRF) vulnerability in Chamilo 1.11.14
A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.
network
chamilo CWE-352
6.8
2021-12-03 CVE-2021-35413 Code Injection vulnerability in Chamilo LMS
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.
network
chamilo CWE-94
6.0
2021-12-03 CVE-2021-35414 SQL Injection vulnerability in Chamilo LMS
Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.
network
low complexity
chamilo CWE-89
7.5