chamilo

Records163All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical22CVSS 9.0–10.0

CVSS high65CVSS 7.0–8.9

Exploited now

chamilo records in CISA KEV

No chamilo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Chamilo Lms 122 records HIGH Chamilo 26 records CRITICAL

Records

122 records in Chamilo Lms · all components

TI-2025-32070 CVE-2025-50187

Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

HIGH 82

Chamilo is a learning management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01 Published 2026-03-02 Fixed in 1.11.28 CWE-95

TI-2025-32081 CVE-2025-50198

Deserialization of untrusted data in chamilo-lms

HIGH 77

Chamilo is a learning management system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.004 Published 2026-03-02 Fixed in 1.11.30 CWE-502

TI-2024-32140 CVE-2024-47886

Chamilo: Post-Auth Remote Code Execution

HIGH 77

Chamilo is a learning management system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01053 Published 2026-03-02 Fixed in 1.11.28 CWE-502

TI-2023-03907 CVE-2023-4220 · GHSA-9wc2-3gq5-2f4c

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

HIGH 74

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attac…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.76084 Published 2023-11-28 No fix listed CWE-434

TI-2025-32595 CVE-2025-52468

Chamilo: Stored XSS Vulnerability via CSV User Import

HIGH 73

Chamilo is a learning management system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0041 Published 2026-03-02 Fixed in 1.11.30 CWE-79

TI-2024-20321 CVE-2024-30616 · GHSA-7hpj-6m83-46cj

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile.

HIGH 73

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00597 Published 2024-11-04 No fix listed CWE-863

TI-2023-03910 CVE-2023-4223 · GHSA-73v5-4v68-mjjx

Chamilo LMS File Upload Functionality Remote Code Execution

HIGH 73

Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0183 Published 2023-11-28 No fix listed CWE-434

TI-2025-32608 CVE-2025-52482

Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php

HIGH 71

Chamilo is a learning management system.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00435 Published 2026-03-02 Fixed in 1.11.30 CWE-79

TI-2025-32075 CVE-2025-50192

Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php

HIGH 71

Chamilo is a learning management system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00668 Published 2026-03-02 Fixed in 1.11.30 CWE-89

TI-2025-32073 CVE-2025-50190

Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script

HIGH 71

Chamilo is a learning management system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00668 Published 2026-03-02 Fixed in 1.11.30 CWE-89

TI-2026-24485 CVE-2026-31939

Path Traversal (Arbitrary File Delete) in Chamilo LMS

HIGH 69

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00356 Published 2026-04-10 Fixed in 1.11.38 CWE-22

TI-2024-18294 CVE-2024-27524 · GHSA-hgcm-4hjv-p97p

Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to…

HIGH 66

Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00757 Published 2024-11-01 No fix listed CWE-79

TI-2025-32072 CVE-2025-50189

Chamilo: Error-based SQL Injection

HIGH 65

Chamilo is a learning management system.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00834 Published 2026-03-02 Fixed in 1.11.30 CWE-89

TI-2026-26081 CVE-2026-33702

Chamilo LMS has an Insecure Direct Object Reference (IDOR)

MEDIUM 64

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-639

TI-2026-25353 CVE-2026-32894

Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result

MEDIUM 64

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00291 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-476

TI-2025-32596 CVE-2025-52469

Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass

MEDIUM 64

Chamilo is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00329 Published 2026-03-02 Fixed in 1.11.30 CWE-841

TI-2025-32080 CVE-2025-50197

Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.0302 Published 2026-03-02 Fixed in 1.11.30 CWE-78

TI-2025-32079 CVE-2025-50196

Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.03121 Published 2026-03-02 Fixed in 1.11.30 CWE-78

TI-2025-32078 CVE-2025-50195

Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.0302 Published 2026-03-02 Fixed in 1.11.30 CWE-78

TI-2025-32077 CVE-2025-50194

Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.03045 Published 2026-03-02 Fixed in 1.11.30 CWE-78

TI-2025-32076 CVE-2025-50193

Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.0302 Published 2026-03-02 Fixed in 1.11.30 CWE-78

TI-2025-32074 CVE-2025-50191

Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00623 Published 2026-03-02 Fixed in 1.11.30 CWE-89

TI-2025-32071 CVE-2025-50188

Error-based SQL Injection in Chamilo LMS

MEDIUM 64

Chamilo is a learning management system.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00822 Published 2026-03-02 Fixed in 1.11.30 CWE-89

TI-2024-20323 CVE-2024-30618 · GHSA-2m6f-fj9h-6vmp

A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote…

MEDIUM 60

A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_top…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00414 Published 2024-11-04 No fix listed CWE-79

TI-2025-42883 CVE-2025-69581 · GHSA-m36g-fvpc-hvm4

An issue was discovered in Chamillo LMS 1.11.2.

MEDIUM 58

An issue was discovered in Chamillo LMS 1.11.2.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00238 Published 2026-01-16 No fix listed CWE-524

Open these records in search →