Skip to contentChamilo Chamilo-lms vulnerabilities
- chamilo chamilo-lms, lms +1 moreChamilo: Unauthorized access to update category of any userCVE-2025-595446.9 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Account Takeover via Stored XSS in Course DescriptionCVE-2025-595439.1 Critical
- chamilo chamilo-lms, lms +1 moreChamilo: Account Takeover via Stored XSS in Course Learning PathsCVE-2025-595429.1 Critical
- chamilo chamilo-lms, lms +1 moreChamilo: CSRF Vulnerability in Project DeletionCVE-2025-595418.1 High
- chamilo lms, chamilo-lms +1 moreChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackCVE-2025-595406.4 Medium
- chamilo lms, chamilo-lms +1 moreChamilo: Stored Cross Site Scripting in Skills ArgumentationCVE-2025-552898.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded FilesCVE-2025-552089.1 Critical
- chamilo chamilo-lms, lms +1 moreChamilo: HTML injection via open parameterCVE-2025-525646.9 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: PHAR deserialization bypassCVE-2025-529987.0 High
- chamilo chamilo-lms, lms +1 moreChamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)CVE-2025-501997.7 High
- chamilo chamilo-lms, lms +1 moreChamilo: Reflected XSS via page parameterCVE-2025-525635.1 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Reflected XSS via keyword_inactive parameterCVE-2025-524755.1 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Reflected XSS via keyword_active parameterCVE-2025-524765.1 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Stored Cross-Site Scripting (XSS) via Session Category NameCVE-2025-524704.8 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation BypassCVE-2025-524697.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: Stored XSS Vulnerability via CSV User ImportCVE-2025-524688.8 High
- chamilo chamilo-lms, lms +1 moreChamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parametersCVE-2025-501988.8 High
- chamilo chamilo-lms, lms +1 moreChamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameterCVE-2025-501977.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameterCVE-2025-501967.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.phpCVE-2025-501957.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpCVE-2025-501947.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterCVE-2025-501937.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: Time-based SQL Injection in /main/webservices/registration.soap.phpCVE-2025-501928.8 High
- chamilo chamilo-lms, lms +1 moreChamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php scriptCVE-2025-501917.0 High
- chamilo chamilo-lms, lms +1 moreChamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php scriptCVE-2025-501908.8 High
- chamilo chamilo-lms, lms +1 moreChamilo: Error-based SQL InjectionCVE-2025-501897.2 High
- chamilo lms, chamilo-lms +1 moreError-based SQL Injection in Chamilo LMSCVE-2025-501887.0 High
- chamilo chamilo-lms, lms +1 moreChamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.phpCVE-2025-524828.3 High
- chamilo chamilo-lms, lms +1 moreChamilo: Evaluation of untrusted user input leads to Remote Code ExecutionCVE-2025-501879.8 Critical
- chamilo chamilo-lms, lms +1 moreChamilo: Stored XSS via Malicious CSV Filename in user_import.phpCVE-2025-501864.8 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Potential unauthenticated blind SSRF via openid functionCVE-2024-503375.3 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Post-Auth Remote Code ExecutionCVE-2024-478868.7 High