Description

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Remediation

References

CVE-2023-34960

Related Vulnerabilities

Resin Application Server Other Vulnerability (CVE-2004-0281)

WordPress Plugin Image Gallery with Slideshow Multiple Vulnerabilities (1.5.2)

MediaWiki Improper Restriction of XML External Entity Reference Vulnerability (CVE-2014-9487)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-60313)

WordPress Plugin WP Live.php 's' Parameter Cross-Site Scripting (1.2.1)

Severity

Critical

Classification

CVE-2023-34960 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities