CRITICAL🇵🇱 Wersja polska

CVE-2023-34960

CVSS 9.8v3.1pub. 2023-08-01upd. 2026-07-09

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Chamilo

    APP
    Chamilo
    1.11.0 – 1.11.18
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-3368CRITICAL9.8PL ✓same product

Command injection w Chamilo LMS umożliwiający RCE bez uwierzytelnienia

CVE-2023-3533CRITICAL9.8PL ✓same product

Path Traversal i RCE w Chamilo LMS — nieuwierzytelniony zapis pliku

CVE-2023-3545CRITICAL9.8PL ✓same product

Chamilo LMS – ominięcie ochrony upload plików i RCE przez .htaccess

CVE-2021-34187CRITICAL9.8PL ✓same product

SQL Injection w Chamilo LMS przez parametry filtrowania (nieuwierzytelniony)

CVE-2022-42029HIGH8.8same product

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated ...