CVE-2023-34960: Chamilo

Critical severity, CVSS 9.8. EPSS: 99.3% chance of exploitation in the next 30 days.

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Affected products

• Chamilo Chamilo: from 1.11.0, up to and including 1.11.18

Published 2023-08-01. Last modified 2026-07-09.