CVE-2024-33528: Ilias

Medium severity, CVSS 4.7. EPSS: 0.5% chance of exploitation in the next 30 days.

A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload.

Affected products

• Ilias Ilias: from 7.0, before 7.30 (fixed in 7.30); from 8.0, before 8.11 (fixed in 8.11)

Published 2024-05-21. Last modified 2026-06-17.