CVE-2026-80428Suited to automated attack · CISA
ILIAS PHP Object Injection via Shibboleth Logout
CVSS score
9.3
EPSS probability
%4.7
Risk score
0.4
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)
Makefile Go / Python
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE
Makefile Go / Python
Similar Vulnerabilities
8.7
CVE-2026-107639
ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
IE
Patch verifiedEPSS %1
8.7
CVE-2026-82538
ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter
IE
Patch verifiedEPSS %1
8.7
CVE-2026-108113
ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
IE
Patch verifiedEPSS %1
8.7
CVE-2026-110761
ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import
IE
Patch verifiedEPSS %1
7.1
CVE-2026-82877
ILIAS Arbitrary File Read via SOAP addFile
IE
Patch verifiedEPSS %1
5.3
CVE-2026-86416
ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods
IE
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-80428"