Filtered by vendor Ilias
Subscriptions
Filtered by product Ilias
Subscriptions
Total
38 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-33526 | 1 Ilias | 1 Ilias | 2025-06-04 | 7.1 High |
| A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | ||||
| CVE-2024-33527 | 1 Ilias | 1 Ilias | 2025-06-04 | 5.4 Medium |
| A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. | ||||
| CVE-2024-33528 | 1 Ilias | 1 Ilias | 2025-06-04 | 4.7 Medium |
| A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. | ||||
| CVE-2024-33529 | 1 Ilias | 1 Ilias | 2025-06-04 | 7.2 High |
| ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types. | ||||
| CVE-2022-45917 | 1 Ilias | 1 Ilias | 2025-04-23 | 6.1 Medium |
| ILIAS before 7.16 has an Open Redirect. | ||||
| CVE-2022-45916 | 1 Ilias | 1 Ilias | 2025-04-23 | 5.4 Medium |
| ILIAS before 7.16 allows XSS. | ||||
| CVE-2022-45915 | 1 Ilias | 1 Ilias | 2025-04-23 | 8.8 High |
| ILIAS before 7.16 allows OS Command Injection. | ||||
| CVE-2017-7583 | 1 Ilias | 1 Ilias | 2025-04-20 | N/A |
| ILIAS before 5.2.3 has XSS via SVG documents. | ||||
| CVE-2017-15538 | 1 Ilias | 1 Ilias | 2025-04-20 | N/A |
| Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php. | ||||
| CVE-2014-2090 | 1 Ilias | 1 Ilias | 2025-04-12 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. | ||||
| CVE-2014-2089 | 1 Ilias | 1 Ilias | 2025-04-12 | N/A |
| ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname. | ||||
| CVE-2014-2088 | 1 Ilias | 1 Ilias | 2025-04-12 | N/A |
| Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname. | ||||
| CVE-2007-5806 | 1 Ilias | 1 Ilias | 2025-04-09 | N/A |
| Cross-site scripting (XSS) vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the (1) mailing or (2) forum component, as demonstrated using the style and onmouseover HTML attributes. | ||||
| CVE-2008-5816 | 1 Ilias | 1 Ilias | 2025-04-09 | N/A |
| SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter. | ||||
| CVE-2022-31266 | 1 Ilias | 1 Ilias | 2025-03-20 | 4.3 Medium |
| In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. | ||||
| CVE-2023-36488 | 1 Ilias | 1 Ilias | 2025-02-13 | 5.4 Medium |
| ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). | ||||
| CVE-2023-36484 | 1 Ilias | 1 Ilias | 2024-11-26 | 6.1 Medium |
| ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). | ||||
| CVE-2023-36487 | 1 Ilias | 1 Ilias | 2024-11-26 | 9.8 Critical |
| The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. | ||||
| CVE-2023-36486 | 1 Ilias | 1 Ilias | 2024-11-26 | 7.2 High |
| The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename. | ||||
| CVE-2023-45869 | 1 Ilias | 1 Ilias | 2024-11-21 | 9 Critical |
| ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system. | ||||