Priority CRITICAL 88
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99325 · Published 2023-08-01 · No fix listed CWE-77
Priority CRITICAL 86
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.69671 · Published 2023-11-28 · No fix listed CWE-78
Priority HIGH 82
Chamilo is a learning management system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01 · Published 2026-03-02 · Fixed in 1.11.28 CWE-95
Priority HIGH 77
Chamilo is a learning management system.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.004 · Published 2026-03-02 · Fixed in 1.11.30 CWE-502
Priority HIGH 77
Chamilo is a learning management system.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01053 · Published 2026-03-02 · Fixed in 1.11.28 CWE-502
Priority HIGH 74
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attac…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.76084 · Published 2023-11-28 · No fix listed CWE-434
Priority HIGH 73
Chamilo is a learning management system.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0041 · Published 2026-03-02 · Fixed in 1.11.30 CWE-79
Priority HIGH 73
Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00597 · Published 2024-11-04 · No fix listed CWE-863
Priority HIGH 73
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0183 · Published 2023-11-28 · No fix listed CWE-434
Priority HIGH 73
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01669 · Published 2022-09-29 · No fix listed CWE-434
Priority HIGH 73
Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-02-20 · No fix listed CWE-434
Priority HIGH 71
Chamilo is a learning management system.
CVSS 3.1HIGH 8.3· Network · High privileges · User interaction · EPSS 0.00435 · Published 2026-03-02 · Fixed in 1.11.30 CWE-79
Priority HIGH 71
Chamilo is a learning management system.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00668 · Published 2026-03-02 · Fixed in 1.11.30 CWE-89
Priority HIGH 71
Chamilo is a learning management system.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00668 · Published 2026-03-02 · Fixed in 1.11.30 CWE-89
Priority HIGH 69
Chamilo LMS is a learning management system.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00356 · Published 2026-04-10 · Fixed in 1.11.38 CWE-22
Priority HIGH 66
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
CVSS 3.1HIGH 7.1· Network · Low privileges · User interaction · EPSS 0.00757 · Published 2024-11-01 · No fix listed CWE-79
Priority HIGH 65
Chamilo is a learning management system.
CVSS 4.0HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.00834 · Published 2026-03-02 · Fixed in 1.11.30 CWE-89
Priority MEDIUM 64
Chamilo LMS is a learning management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00247 · Published 2026-04-10 · Fixed in 1.11.38, 2.0.0-RC.3 CWE-639
Priority MEDIUM 64
Chamilo LMS is a learning management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00291 · Published 2026-04-10 · Fixed in 1.11.38, 2.0.0-RC.3 CWE-476
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00329 · Published 2026-03-02 · Fixed in 1.11.30 CWE-841
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 4.0HIGH 7.1· Network · High privileges · No interaction · EPSS 0.0302 · Published 2026-03-02 · Fixed in 1.11.30 CWE-78
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 4.0HIGH 7.1· Network · High privileges · No interaction · EPSS 0.03121 · Published 2026-03-02 · Fixed in 1.11.30 CWE-78
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 4.0HIGH 7.1· Network · High privileges · No interaction · EPSS 0.0302 · Published 2026-03-02 · Fixed in 1.11.30 CWE-78
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 4.0HIGH 7.1· Network · High privileges · No interaction · EPSS 0.03045 · Published 2026-03-02 · Fixed in 1.11.30 CWE-78
Priority MEDIUM 64
Chamilo is a learning management system.
CVSS 4.0HIGH 7.1· Network · High privileges · No interaction · EPSS 0.0302 · Published 2026-03-02 · Fixed in 1.11.30 CWE-78
Load more
THREATIST.IORead the docs