Skip to content
Chamilo Lms vulnerabilities
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Privilege Escalation via API User Role Modification
CVE-2026-40291
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has OS Command Injection via export_all_certificates action
CVE-2026-35196
Public exploit
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses
CVE-2026-34602
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes
CVE-2026-34370
6.5 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution
CVE-2026-34161
5.1 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services
CVE-2026-34160
Public exploit
8.6 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action
CVE-2026-33715
Public exploit
7.2 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)
CVE-2026-33714
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an XML External Entity (XXE) Injection
CVE-2026-33737
5.3 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure
CVE-2026-33736
6.5 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Weak REST API Key Generation (Predictable)
CVE-2026-33710
7.5 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has REST API PII Exposure via get_user_info_from_username
CVE-2026-33708
6.5 Medium
-
chamilo chamilo-lms, lms +1 more
Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms
CVE-2026-33707
9.4 Critical
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)
CVE-2026-33706
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has unauthenticated access to Twig template source files exposes application logic
CVE-2026-33705
5.3 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint
CVE-2026-33704
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens
CVE-2026-33703
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an Insecure Direct Object Reference (IDOR)
CVE-2026-33702
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS affected by unauthenticated RCE in main/install folder
CVE-2026-33698
9.3 Critical
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
CVE-2026-33618
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
CVE-2026-33141
6.5 Medium
-
chamilo lms, chamilo-lms +1 more
OS Command Injection in Chamilo LMS 1.11.36
CVE-2026-32892
9.1 Critical
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit
CVE-2026-32932
4.7 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE
CVE-2026-32931
7.5 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check
CVE-2026-32930
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result
CVE-2026-32894
7.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination
CVE-2026-32893
5.4 Medium
-
chamilo lms, chamilo-lms +1 more
Server-Side Request Forgery (SSRF) in Chamilo LMS
CVE-2026-31941
7.7 High
-
chamilo lms, chamilo-lms +1 more
Session Fixation in Chamilo LMS
CVE-2026-31940
7.5 High
-
chamilo lms, chamilo-lms +1 more
Path Traversal (Arbitrary File Delete) in Chamilo LMS
CVE-2026-31939
8.3 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has validation-less redirect on login page
CVE-2025-66447
0.0 None
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: Reflected XSS in the session category listing page
CVE-2026-30882
6.1 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: SQL Injection in the statistics AJAX endpoint
CVE-2026-30881
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: User enumeration vulnerability via response
CVE-2026-30876
6.3 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS: Authenticated RCE via H5P Import
CVE-2026-30875
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php
CVE-2026-28430
9.3 Critical
-
chamilo lms, chamilo-lms +1 more
Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload
CVE-2026-29041
Public exploit
8.8 High
-
chamilo chamilo-lms, lms +1 more
Chamilo: Unauthorized access to update category of any user
CVE-2025-59544
6.9 Medium
-
chamilo chamilo-lms, lms +1 more
Chamilo: Account Takeover via Stored XSS in Course Description
CVE-2025-59543
9.1 Critical
-
chamilo chamilo-lms, lms +1 more
Chamilo: Account Takeover via Stored XSS in Course Learning Paths
CVE-2025-59542
9.1 Critical
-
chamilo chamilo-lms, lms +1 more
Chamilo: CSRF Vulnerability in Project Deletion
CVE-2025-59541
8.1 High
-
chamilo lms, chamilo-lms +1 more
Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback
CVE-2025-59540
6.4 Medium
-
chamilo lms, chamilo-lms +1 more
Chamilo: Stored Cross Site Scripting in Skills Argumentation
CVE-2025-55289
8.8 High
-
chamilo lms, chamilo-lms +1 more
Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files
CVE-2025-55208
9.1 Critical
-
chamilo chamilo-lms, lms +1 more
Chamilo: HTML injection via open parameter
CVE-2025-52564
6.9 Medium
-
chamilo chamilo-lms, lms +1 more
Chamilo: PHAR deserialization bypass
CVE-2025-52998
7.0 High
-
chamilo chamilo-lms, lms +1 more
Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)
CVE-2025-50199
7.7 High
-
chamilo chamilo-lms, lms +1 more
Chamilo: Reflected XSS via page parameter
CVE-2025-52563
5.1 Medium
-
chamilo chamilo-lms, lms +1 more
Chamilo: Reflected XSS via keyword_inactive parameter
CVE-2025-52475
5.1 Medium
-
chamilo chamilo-lms, lms +1 more
Chamilo: Reflected XSS via keyword_active parameter
CVE-2025-52476
5.1 Medium
- Show olderLoading…