Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

163 records

Vendor: chamilo Clear all filters
TI-2026-78771 CVE-2026-114390 · GHSA-h28r-m2q7-jx9p

Missing authorization in Chamilo LMS AJAX handlers exposes learner data

Priority LOW 36

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00227 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-862
TI-2026-78770 CVE-2026-114389 · GHSA-f6m7-pgw8-2v88

Chamilo LMS open answer grading lets users grade others' exams

Priority LOW 24

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-639
TI-2026-78769 CVE-2026-114388 · GHSA-xf7w-4v4m-pq7h

Chamilo LMS missing authorization lets attackers change course certificates

Priority LOW 36

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00167 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-862
TI-2026-76214 CVE-2026-112031 · GHSA-pr76-c2mp-rqp4

Cross-site scripting in Chamilo LMS Ticket Module

Priority MEDIUM 56

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00254 Published 2026-10-18 No fix listed CWE-79
TI-2026-56892 CVE-2026-82535 · GHSA-xf2f-2vj2-6hfr

Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Priority LOW 25

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitatio…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00474 Published 2026-09-11 Fixed in 1.11.42, 3.0.0 CWE-79
TI-2026-26534 CVE-2026-34239

Chamilo Authenticated Remote Code Execution

Priority LOW 35

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00465 Published 2026-07-20 No fix listed CWE-285
TI-2026-28757 CVE-2026-39878

Chamilo stored XSS via user registration leads to admin account takeover

Priority MEDIUM 40

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's br…

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00435 Published 2026-07-20 No fix listed CWE-79
TI-2026-26460 CVE-2026-34160

Missing authentication in chamilo-lms

Priority MEDIUM 43

Chamilo LMS is an open-source learning management system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00344 Published 2026-04-14 Fixed in 2.0-RC.3 CWE-306
Load more