https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-36944.htmlhttps://patchthecve.com/cve/CVE-2020-36944.htmlWed, 17 Jun 2026 03:16:34 +0000MEDIUM 4.0: ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDFhttps://patchthecve.com/cve/CVE-2025-11346.htmlhttps://patchthecve.com/cve/CVE-2025-11346.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.3: A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 https://patchthecve.com/cve/CVE-2025-11345.htmlhttps://patchthecve.com/cve/CVE-2025-11345.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 5.5: A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading thttps://patchthecve.com/cve/CVE-2025-11344.htmlhttps://patchthecve.com/cve/CVE-2025-11344.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.3: A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addhttps://patchthecve.com/cve/CVE-2024-33529.htmlhttps://patchthecve.com/cve/CVE-2024-33529.htmlWed, 17 Jun 2026 07:31:55 +0000HIGH 7.2: ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types.https://patchthecve.com/cve/CVE-2024-33528.htmlhttps://patchthecve.com/cve/CVE-2024-33528.htmlWed, 17 Jun 2026 07:31:55 +0000MEDIUM 4.7: A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload.https://patchthecve.com/cve/CVE-2024-33527.htmlhttps://patchthecve.com/cve/CVE-2024-33527.htmlWed, 17 Jun 2026 07:31:55 +0000MEDIUM 5.4: A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.https://patchthecve.com/cve/CVE-2024-33526.htmlhttps://patchthecve.com/cve/CVE-2024-33526.htmlWed, 17 Jun 2026 07:31:55 +0000HIGH 7.1: A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.