Threats affecting pkg:github/chamilo/chamilo-lms

85 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.4	EPSS 0.2%	CVE-2024-30617chamilo-lms · A Cross-Site Request Forgery (CSRF) Medium5.4EPSS 0.2%2024-11-04CVE Database V5CVE-2024-30617 A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-11-04
High	8.8	EPSS 0.6%	CVE-2024-30616chamilo-lms · Incorrect Authorization High8.8EPSS 0.6%2024-11-04CVE Database V5CVE-2024-30616 Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity. EPSS 0.6%Vulnerability CWE-863	CVE Database V5	2024-11-04
Medium	4.6	EPSS 0.4%	CVE-2024-27525chamilo-lms · Cross-site Scripting Medium4.6EPSS 0.4%2024-11-01CVE Database V5CVE-2024-27525 Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-11-01
High	7.1	EPSS 0.8%	CVE-2024-27524chamilo-lms · Cross-site Scripting High7.1EPSS 0.8%2024-11-01CVE Database V5CVE-2024-27524 Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component. EPSS 0.8%Vulnerability CWE-79	CVE Database V5	2024-11-01
High	8.8	EPSS 1.8%	CVE-2023-4225Chamilo · Unrestricted File Upload High8.8EPSS 1.8%2023-11-28CVE Database V5CVE-2023-4225 Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. EPSS 1.8%Vulnerability CWE-434	CVE Database V5	2023-11-28

Page 5 of 5