IL
Product
ILIAS
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 8Medium 24Low 2
Watch
Add ILIAS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-45867 | 6.5 | Oct 26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module Affected: 7.25 |
| CVE-2022-45918 | 6.5 | Dec 7 | ILIAS before 7.16 allows External Control of File Name or Path Affected: before 7.16 |
| CVE-2020-23995 | 6.5 | May 13 | An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload Affected: before 5.3.19; 5.4.0 before 5.4.12 |
| CVE-2026-85135 | 6.3 | Sep 3 | ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload Affected: 9.0; 9.1; 9.2; 9.3; 9.4; 9.5; +29 more |
| CVE-2023-36484 | 6.1 | Jun 29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS) Affected: 8.0 through 8.2; 7.21; 8.0; 8.0; 8.0; 8.0 |
| CVE-2022-45917 | 6.1 | Dec 7 | ILIAS before 7.16 has an Open Redirect Affected: before 7.16 |
| CVE-2019-1010237 | 6.1 | Jul 22 | Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent) Affected: 5.2.0 before 5.2.21; 5.3.0 before 5.3.12 |
| CVE-2018-10428 | 6.1 | May 23 | ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected… Affected: before 5.1.26; 5.2.0 before 5.2.15; 5.3.0 before 5.3.4 |
| CVE-2018-10307 | 6.1 | May 18 | error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception Affected: 5.2.0 before 5.3.4 |
| CVE-2018-10306 | 6.1 | May 18 | Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid… Affected: 5.1.0 before 5.3.4 |
| CVE-2018-11120 | 6.1 | May 17 | Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS Affected: 5.1.0 through 5.1.26; 5.2.0 through 5.2.15; 5.3.0 through 5.3.4; 5.1.0; 5.2.0; 5.2.0; +1 more |
| CVE-2018-11119 | 6.1 | May 17 | ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter Affected: 5.1.0 through 5.1.26; 5.2.0 through 5.2.15; 5.3.0 through 5.3.4; 5.1.0; 5.2.0; 5.2.0; +1 more |
| CVE-2018-11118 | 6.1 | May 17 | The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php Affected: 5.1.0 through 5.1.26; 5.2.0 through 5.2.15; 5.3.0 through 5.3.4; 5.1.0; 5.2.0; 5.2.0; +1 more |
| CVE-2018-11117 | 6.1 | May 17 | Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute Affected: 5.1.0 through 5.1.26; 5.2.0 through 5.2.15; 5.3.0 through 5.3.4; 5.1.0; 5.2.0; 5.2.0; +1 more |
| CVE-2018-10665 | 6.1 | May 2 | ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files Affected: 5.3.4 |
| CVE-2018-5688 | 6.1 | Jan 14 | ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component Affected: before 5.2.4 |
| CVE-2017-7583 | 6.1 | Apr 7 | ILIAS before 5.2.3 has XSS via SVG documents Affected: through 5.2.2 |
| CVE-2024-33527 | 5.4 | May 21 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote… Affected: 7.0 before 7.30; 8.0 before 8.11 |
| CVE-2023-36488 | 5.4 | Jun 29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS) Affected: 8.0 through 8.2; 7.21 |
| CVE-2022-45916 | 5.4 | Dec 7 | ILIAS before 7.16 allows XSS Affected: before 7.16 |
| CVE-2020-25267 | 5.4 | Nov 10 | An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4 Affected: 6.4.0 |
| CVE-2017-15538 | 5.4 | Oct 17 | Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator… Affected: through 5.1.21; 5.2.0 before 5.2.9 |
| CVE-2024-33528 | 4.7 | May 21 | A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary… Affected: 7.0 before 7.30; 8.0 before 8.11 |
| CVE-2022-31266 | 4.3 | Jun 29 | In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts Affected: through 7.10 |
Showing 24