Browse CVEs

CRITICAL 9.8 CVE-2025-11346 A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such ma… Ilias Mitigation only Fix from $2,3002025-10-06 CRITICAL 9.8 CVE-2025-11344 A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate I… Ilias Mitigation only Fix from $2,3002025-10-06 CRITICAL 9.8 CVE-2025-11345 A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulati… Ilias Mitigation only Fix from $2,3002025-10-06 HIGH 7.2 CVE-2024-33529 ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute opera… Ilias 7.30 / 8.11+ Fix from $1,9502024-05-21 MEDIUM 5.4 CVE-2024-33527 A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8… Ilias 7.30 / 8.11+ Fix from $1,6002024-05-21 HIGH 7.1 CVE-2024-33526 A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 befo… Ilias 7.30 / 8.11+ Fix from $1,9502024-05-21 HIGH 7.2 CVE-2023-36485 The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application serve… Ilias 7.23 / 8.3+ Fix from $1,9502023-12-25 HIGH 7.2 CVE-2023-36486 The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application serve… Ilias 7.23 / 8.3+ Fix from $1,9502023-12-25 CRITICAL 9.0 CVE-2023-45869 ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account acces… Ilias No fix yet Fix from $2,3002023-10-26 HIGH 8.1 CVE-2023-45868 The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal a… Ilias No fix yet Fix from $1,9502023-10-26 MEDIUM 6.5 CVE-2023-45867 ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker … Ilias No fix yet Fix from $1,6002023-10-26 MEDIUM 6.1 CVE-2023-36484 ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). Ilias after 8.2 Fix from $1,6002023-06-29 CRITICAL 9.8 CVE-2023-36487 The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. Ilias after 8.1 Fix from $2,3002023-06-29 MEDIUM 5.4 CVE-2023-36488 ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). Ilias after 8.2 Fix from $1,6002023-06-29 HIGH 8.8 CVE-2022-45915 ILIAS before 7.16 allows OS Command Injection. Ilias 7.16+ Fix from $1,9502022-12-07 MEDIUM 6.5 CVE-2022-45918 ILIAS before 7.16 allows External Control of File Name or Path. Ilias 7.16+ Fix from $1,6002022-12-07 MEDIUM 6.1 CVE-2022-45917 ILIAS before 7.16 has an Open Redirect. Ilias 7.16+ Fix from $1,6002022-12-07 MEDIUM 5.4 CVE-2022-45916 ILIAS before 7.16 allows XSS. Ilias 7.16+ Fix from $1,6002022-12-07 HIGH 8.8 CVE-2020-23996 A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the i… Ilias 5.3.19 / 5.4.10+ Fix from $1,9502021-05-13 MEDIUM 6.5 CVE-2020-23995 An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via … Ilias 5.3.19 / 5.4.12+ Fix from $1,6002021-05-13 HIGH 8.8 CVE-2020-25268 Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. Ilias No fix yet Fix from $1,9502020-11-10 MEDIUM 5.4 CVE-2020-25267 An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4. Ilias No fix yet Fix from $1,6002020-11-10 MEDIUM 6.1 CVE-2019-1010237 Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Exe… Ilias 5.2.21 / 5.3.12+ Fix from $1,6002019-07-22 MEDIUM 6.1 CVE-2018-10428 ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of… Ilias 5.1.26 / 5.2.15+ Fix from $1,6002018-05-23 MEDIUM 6.1 CVE-2018-10306 Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3… Ilias 5.3.4+ Fix from $1,6002018-05-18 MEDIUM 6.1 CVE-2018-10307 error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. Ilias 5.3.4+ Fix from $1,6002018-05-18 MEDIUM 6.1 CVE-2018-11117 Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. Ilias after 5.3.4 Fix from $1,6002018-05-17 MEDIUM 6.1 CVE-2018-11118 The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. Ilias after 5.3.4 Fix from $1,6002018-05-17 MEDIUM 6.1 CVE-2018-11119 ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. Ilias after 5.3.4 Fix from $1,6002018-05-17 MEDIUM 6.1 CVE-2018-11120 Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. Ilias after 5.3.4 Fix from $1,6002018-05-17