News & Sicurezza

CVE ID : CVE-2025-50189 Published : March 2, 2026, 3:16 p.m. | 28 minutes ago Description : Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-52482 Published : March 2, 2026, 3:16 p.m. | 28 minutes ago Description : Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-50192 Published : March 2, 2026, 3:16 p.m. | 28 minutes ago Description : Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-50191 Published : March 2, 2026, 3:16 p.m. | 28 minutes ago Description : Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-50190 Published : March 2, 2026, 3:16 p.m. | 28 minutes ago Description : Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

VS waarschuwt voor 'slapende' malware op Ivanti vpn-servers Het Amerikaanse cyberagentschap CISA waarschuwt organisaties voor 'slapende' malware op hun Ivanti vpn-servers. Een jaar geleden kwam het Cybersecurity and Infrastructure Security Agency (CISA) van he ... Read more Published Date: Mar 02, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2025-0282

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, e ... Read more Published Date: Mar 02, 2026 (1 day ago) Vulnerabilities has been mentioned in this article.

CVE ID : CVE-2026-3432 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3431 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-14532 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-12462 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind SQL Injection. This issue was fixed in versions above 8.0. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerabilities in DobryCMS software Vulnerabilities in DobryCMS software CVE ID CVE-2025-12462 Publication date 02 March 2026 Vendor Studio Fabryka Product DobryCMS Vulnerable versions Up to 8.0 Vulnerability type (CWE) Improper Neutral ... Read more Published Date: Mar 02, 2026 (22 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-14532 CVE-2025-12462