Vulnerabilities

Filters

2 selected

122 records

Sort

Vendor: chamilo Component: Chamilo Lms Clear all filters

TI-2026-29073 CVE-2026-40291

Chamilo LMS has Privilege Escalation via API User Role Modification

MEDIUM 40

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00316 Published 2026-04-14 Fixed in 2.0-RC.3 CWE-269

TI-2026-27349 CVE-2026-35196

Chamilo LMS has OS Command Injection via export_all_certificates action

MEDIUM 44

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0176 Published 2026-04-14 Fixed in 2.0.0-RC.3 CWE-78

TI-2026-26849 CVE-2026-34602

Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses

LOW 31

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00203 Published 2026-04-14 Fixed in 2.0.0-RC.3 CWE-639

TI-2026-26656 CVE-2026-34370

Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes

LOW 28

Chamilo LMS is an open-source learning management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00227 Published 2026-04-14 Fixed in 2.0.0-RC.3 CWE-285

TI-2026-26461 CVE-2026-34161

Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution

LOW 23

Chamilo LMS is an open-source learning management system.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00219 Published 2026-04-14 Fixed in 2.0.0-RC.3 CWE-79

TI-2026-26460 CVE-2026-34160

Missing authentication in chamilo-lms

MEDIUM 43

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00344 Published 2026-04-14 Fixed in 2.0-RC.3 CWE-306

TI-2026-26094 CVE-2026-33715

Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action

LOW 37

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00208 Published 2026-04-14 Fixed in 2.0-RC.3 CWE-306

TI-2026-26093 CVE-2026-33714

Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)

LOW 31

Chamilo is an open-source learning management system (LMS).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-04-14 Fixed in 2.0.0 CWE-89

TI-2026-26116 CVE-2026-33737

Chamilo LMS has an XML External Entity (XXE) Injection

LOW 28

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-611

TI-2026-26115 CVE-2026-33736

Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure

LOW 28

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00217 Published 2026-04-10 Fixed in 2.0.0-RC.3 CWE-639

TI-2026-26089 CVE-2026-33710

Chamilo LMS has Weak REST API Key Generation (Predictable)

LOW 39

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00293 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-330

TI-2026-26087 CVE-2026-33708

Chamilo LMS has REST API PII Exposure via get_user_info_from_username

LOW 28

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00217 Published 2026-04-10 Fixed in 1.11.38 CWE-862

TI-2026-26086 CVE-2026-33707

Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

MEDIUM 49

Chamilo LMS is a learning management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00434 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-640

TI-2026-26085 CVE-2026-33706

Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)

LOW 30

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00175 Published 2026-04-10 Fixed in 1.11.38 CWE-269

TI-2026-26084 CVE-2026-33705

Chamilo LMS has unauthenticated access to Twig template source files exposes application logic

LOW 30

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2026-04-10 Fixed in 1.11.38 CWE-538

TI-2026-26083 CVE-2026-33704

Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint

LOW 38

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00436 Published 2026-04-10 Fixed in 1.11.38 CWE-434

TI-2026-26082 CVE-2026-33703

Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens

LOW 36

Chamilo LMS is a learning management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00181 Published 2026-04-10 Fixed in 2.0.0-RC.3 CWE-639

TI-2026-26081 CVE-2026-33702

Chamilo LMS has an Insecure Direct Object Reference (IDOR)

MEDIUM 64

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-639

TI-2026-26077 CVE-2026-33698

Chamilo LMS affected by unauthenticated RCE in main/install folder

MEDIUM 48

Chamilo LMS is a learning management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00334 Published 2026-04-10 Fixed in 1.11.38 CWE-552

TI-2026-26000 CVE-2026-33618

Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings

MEDIUM 40

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-10 Fixed in 2.0.0-RC.3 CWE-95

TI-2026-25571 CVE-2026-33141

Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data

LOW 28

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00147 Published 2026-04-10 Fixed in 2.0.0-RC.3 CWE-639

TI-2026-25351 CVE-2026-32892

OS Command Injection in Chamilo LMS 1.11.36

MEDIUM 44

Chamilo LMS is a learning management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01554 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-78

TI-2026-25380 CVE-2026-32932

Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit

LOW 26

Chamilo LMS is a learning management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00184 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-601

TI-2026-25379 CVE-2026-32931

Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE

MEDIUM 41

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-434

TI-2026-25378 CVE-2026-32930

Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check

LOW 31

Chamilo LMS is a learning management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.002 Published 2026-04-10 Fixed in 1.11.38, 2.0.0-RC.3 CWE-639