Description
Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
Remediation
References
Related Vulnerabilities
SharePoint Missing Authentication for Critical Function Vulnerability (CVE-2026-56164)
Drupal Core 8.9.x Cross-Site Request Forgery (8.9.0 - 8.9.18)
WordPress Plugin copy-me Cross-Site Request Forgery (1.0.0)
Magento Deserialization of Untrusted Data Vulnerability (CVE-2020-3716)
IBM RTC Inadequate Encryption Strength Vulnerability (CVE-2017-1701)