Security-Blog
July 2026
Following 5 security issues have been resolved:
0047800: Stored XSS via HTML attribute injection
0047834: Add RBAC check for Repository Objects
0047887: SOAP: Insecure Direct Object Reference (IDOR)
0047952: Object: Remove Information on Temp File Location from Error Message
0047954: Notes: Insufficient access checks
Following 5 security issues have been resolved:
0047800: Stored XSS via HTML attribute injection
0047834: Add RBAC check for Repository Objects
0047887: SOAP: Insecure Direct Object Reference (IDOR)
0047952: Object: Remove Information on Temp File Location from Error Message
0047954: Notes: Insufficient access checks
Following 6 security issues have been resolved:
0046642: Data Collection: Stored XSS with TinyMCE
0047800: Stored XSS via HTML attribute injection
0047834: Add RBAC check for Repository Objects
0047887: SOAP: Insecure Direct Object Reference (IDOR)
0047952: Object: Remove Information on Temp File Location from Error Message
0047954: Notes: Insufficient access checks
May 2026
Following 9 security issues have been resolved:
0047258: SOAP: Unauthorized function call
0047472: SQL injection in SOAP
0047581: Broken Access Control in SOAP
0047691: SQL injection in ILIAS MyStaff
0047692: Fixes a path traversal vulnerability in the custom icon upload
0047749: Fix Sanitation of Answer Options in the Presentation of Statistics in the View to Correct Points.
0047770: Tracking: validate sort field from LP participants table
0047778: Authenticated SQLi in SCORM2004
0047787: Add an AccessControl-Check to TileImageUploadHandler
Following 9 security issues have been resolved:
0047258: SOAP: Unauthorized function call
0047472: SQL injection in SOAP
0047581: Broken Access Control in SOAP
0047691: SQL injection in ILIAS MyStaff
0047692: Fixes a path traversal vulnerability in the custom icon upload
0047749: Fix Sanitation of Answer Options in the Presentation of Statistics in the View to Correct Points.
0047770: Tracking: validate sort field from LP participants table
0047778: Authenticated SQLi in SCORM2004
0047787: Add an AccessControl-Check to TileImageUploadHandler