CVE-2023-3533

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Nov 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-353307.5Windows Extended Negotiation Denial of Service VulnerabilityCVE-2023-353316.5Windows Local Security Authority (LSA) Denial of Service VulnerabilityCVE-2023-353326.8Windows Remote Desktop Protocol Security Feature BypassCVE-2023-353337.5MediaWiki PandocUpload Extension Remote Code Execution VulnerabilityCVE-2023-353358.2Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityCVE-2023-353365.4Windows MSHTML Platform Security Feature Bypass VulnerabilityCVE-2023-353377.8Win32k Elevation of Privilege VulnerabilityCVE-2023-353387.5Windows Peer Name Resolution Protocol Denial of Service VulnerabilityCVE-2023-353397.5Windows CryptoAPI Denial of Service VulnerabilityCVE-2023-35347.5A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of theCVE-2023-353407.8Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityCVE-2023-353415.5Microsoft DirectMusic Information Disclosure Vulnerability
CVE-2023-3533: Critical severity, CVSS 9.8 | Vulnix