Vulnerabilities > Ilias

DATE CVE VULNERABILITY TITLE RISK
2014-03-02 CVE-2014-2089 Code Injection vulnerability in Ilias 4.4.1
ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.
network
ilias CWE-94
6.8
2014-03-02 CVE-2014-2088 Unspecified vulnerability in Ilias 4.4.1
Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname.
network
low complexity
ilias
6.5
2009-01-02 CVE-2008-5816 SQL Injection vulnerability in Ilias
SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter.
network
low complexity
ilias CWE-89
7.5
2007-11-05 CVE-2007-5806 Cross-Site Scripting vulnerability in Ilias
Cross-site scripting (XSS) vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the (1) mailing or (2) forum component, as demonstrated using the style and onmouseover HTML attributes.
network
ilias CWE-79
4.3