Chamilo Chamilo-lms vulnerabilities

• chamilo chamilo-lms Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated CVE-2026-45146 7.2 HighNovember 3, 2026
• chamilo chamilo-lms Chamilo LMS: Conditional PHP execution through vendored QuickForm eval CVE-2026-44344 6.6 MediumOctober 30, 2026
• chamilo chamilo-lms Chamilo LMS: CSRF in destructive skill-management AJAX actions CVE-2026-45141 6.5 MediumOctober 30, 2026
• chamilo chamilo-lms Chamilo LMS: Database-backed PHP object injection in career deserialization CVE-2026-45145 7.5 HighOctober 30, 2026
• chamilo chamilo-lms Chamilo LMS: Stored XSS in public user-profile fields CVE-2026-45144 8.9 HighOctober 30, 2026
• chamilo chamilo-lms Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers CVE-2026-114390 6.9 MediumOctober 21, 2026
• chamilo chamilo-lms Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade CVE-2026-114389 5.3 MediumOctober 21, 2026
• chamilo chamilo-lms Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController CVE-2026-114388 6.9 MediumOctober 21, 2026
• chamilo chamilo-lms Chamilo LMS CStudio upload flow allows unauthenticated remote code execution CVE-2026-45140 Public exploitFix available 9.8 CriticalSeptember 17, 2026
• chamilo chamilo-lms Chamilo LMS: Student-to-admin stored XSS in private messages via v-html CVE-2026-45143 9.0 CriticalSeptember 17, 2026
• chamilo chamilo-lms Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php CVE-2026-82535 5.3 MediumSeptember 11, 2026
• chamilo chamilo-lms Chamilo Authenticated Remote Code Execution CVE-2026-34239 7.5 HighJuly 20, 2026
• chamilo chamilo-lms Chamilo stored XSS via user registration leads to admin account takeover CVE-2026-39878 9.3 CriticalJuly 20, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Privilege Escalation via API User Role Modification CVE-2026-40291 8.8 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has OS Command Injection via export_all_certificates action CVE-2026-35196 Public exploit 8.8 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses CVE-2026-34602 7.1 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes CVE-2026-34370 6.5 MediumApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution CVE-2026-34161 5.1 MediumApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services CVE-2026-34160 Public exploit 8.6 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action CVE-2026-33715 Public exploit 7.2 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) CVE-2026-33714 7.1 HighApril 14, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an XML External Entity (XXE) Injection CVE-2026-33737 5.3 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure CVE-2026-33736 6.5 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Weak REST API Key Generation (Predictable) CVE-2026-33710 7.5 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has REST API PII Exposure via get_user_info_from_username CVE-2026-33708 6.5 MediumApril 10, 2026
• chamilo chamilo-lms, lms +1 more Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms CVE-2026-33707 9.4 CriticalApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) CVE-2026-33706 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has unauthenticated access to Twig template source files exposes application logic CVE-2026-33705 5.3 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint CVE-2026-33704 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens CVE-2026-33703 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an Insecure Direct Object Reference (IDOR) CVE-2026-33702 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS affected by unauthenticated RCE in main/install folder CVE-2026-33698 9.3 CriticalApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings CVE-2026-33618 8.8 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data CVE-2026-33141 6.5 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more OS Command Injection in Chamilo LMS 1.11.36 CVE-2026-32892 9.1 CriticalApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit CVE-2026-32932 4.7 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE CVE-2026-32931 7.5 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check CVE-2026-32930 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result CVE-2026-32894 7.1 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination CVE-2026-32893 5.4 MediumApril 10, 2026
• chamilo lms, chamilo-lms +1 more Server-Side Request Forgery (SSRF) in Chamilo LMS CVE-2026-31941 7.7 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Session Fixation in Chamilo LMS CVE-2026-31940 7.5 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Path Traversal (Arbitrary File Delete) in Chamilo LMS CVE-2026-31939 8.3 HighApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS has validation-less redirect on login page CVE-2025-66447 0.0 NoneApril 10, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: Reflected XSS in the session category listing page CVE-2026-30882 6.1 MediumMarch 16, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: SQL Injection in the statistics AJAX endpoint CVE-2026-30881 8.8 HighMarch 16, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: User enumeration vulnerability via response CVE-2026-30876 6.3 MediumMarch 16, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS: Authenticated RCE via H5P Import CVE-2026-30875 8.8 HighMarch 16, 2026
• chamilo lms, chamilo-lms +1 more Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php CVE-2026-28430 9.3 CriticalMarch 16, 2026
• chamilo lms, chamilo-lms +1 more Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload CVE-2026-29041 Public exploit 8.8 HighMarch 6, 2026
• Show olderLoading…