← Back to browse · API

CVE-2023-3368

Severity
CRITICAL
CVSS
9.8
EPSS
0.68897
Risk score
63.31
CISA KEV
No
PoC
No
Published
2023-11-28
Modified
2025-06-03
First seen
2026-08-07
Aliases
EUVD-2023-44035, GHSA-X9XC-JG9P-2J7F
Products
Chamilo:Chamilo 0 ≤1.11.20
Sources
euvd EUVD-2023-44035

Description

Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.

References