CVE-2025-11345: ilias 8.23, 9.13, 10.1; +1 more affected products

CVE-2025-11345. CVSS 3.1 base score 9.8 (CRITICAL, NVD). EPSS 0.00361 (percentile 0.28458), scored 19-Oct-2026.

Affected technology

ilias · 8.23
ilias

ilias · 9.13
ilias

ilias · 10.1
ilias

ILIAS · 8.0, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20, 8.21, 8.22, 8.23, 9.0, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.10, 9.11, 9.12, 9.13, 10.0, 10.1
Vendor not specified by the source

Description’s affected range: up to 8.23/9.13/10.1

Component: Test Import
Function: unserialize

Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 19-Oct-2026 17:58 UTC

CWE: CWE-20, CWE-502
CCR priority: 39.3 /100 (P4)
CVSS 3.1: 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · NVD
EPSS: 0.00361 · percentile 0.28458 · 2026-10-19
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-19 17:57:47.606446+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-11345.html