Chamilo: >> Chamilo Security Vulnerabilities
admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
CVSS Score
6.5
EPSS Score
0.005
Published
2021-05-13
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.
CVSS Score
7.2
EPSS Score
0.123
Published
2021-04-30
Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
CVSS Score
6.1
EPSS Score
0.005
Published
2021-02-19
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.
CVSS Score
6.1
EPSS Score
0.005
Published
2020-02-08
Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-01-30
Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-01-30
Page 3