Page 4 of 32 results (0.004 seconds)

CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 4

CVE-2013-6787 – Chamilo Lms 1.9.6 - 'profile.php?password' SQL Injection

https://notcve.org/view.php?id=CVE-2013-6787

27 Nov 2013 — SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter. Vulnerabilidad de inyección SQL en la función check_user_password en main/auth/profile.php en Chamilo LMS 1.9.6 y anteriores, cuando se utiliza el modo de contraseñas no cifradas durante la instalación, permite a usuarios aut... • https://www.exploit-db.com/exploits/30012 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2012-4030 – Chamilo 1.8.8.4 XSS / File Deletion

https://notcve.org/view.php?id=CVE-2012-4030

27 Aug 2012 — Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. Chamilo versiones anteriores a la versión 1.8.8.6, no maneja adecuadamente la información suministrada por el usuario mediante el script del archivo index.php, lo que podría permitir a atacantes remotos eliminar archivos arbitrarios. Chamilo version 1.8.8.4 suffers from cross site scripting and file deletion vulnerabilities. • https://exchange.xforce.ibmcloud.com/vulnerabilities/78054 • CWE-20: Improper Input Validation •