CH
Product
chamilo-lms
130
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 20High 49Medium 60Low 0
Watch
Add chamilo-lms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45140 | 9.8 | Sep 17 | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution Affected: < 2.0.1 |
| CVE-2026-33707 | 9.8 | Apr 10 | Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms Affected: < 1.11.38; >= 2.0.0-alpha.1, < 2.0.0-RC.3 |
| CVE-2026-33698 | 9.8 | Apr 10 | Chamilo LMS affected by unauthenticated RCE in main/install folder Affected: < 1.11.38 |
| CVE-2026-28430 | 9.8 | Mar 16 | Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php Affected: < 1.11.34 |
| CVE-2025-52998 | 9.8 | Mar 2 | Chamilo: PHAR deserialization bypass Affected: < 1.11.30 |
| CVE-2025-50192 | 9.8 | Mar 2 | Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php Affected: < 1.11.30 |
| CVE-2025-50190 | 9.8 | Mar 2 | Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script Affected: < 1.11.30 |
| CVE-2025-50187 | 9.8 | Mar 2 | Chamilo: Evaluation of untrusted user input leads to Remote Code Execution Affected: < 1.11.28 |
| CVE-2023-34944 | 9.8 | Jun 13 | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG… Affected: 1.11.0 through 1.11.18 |
| CVE-2022-27423 | 9.8 | Apr 15 | Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php Affected: 1.11.0 through 1.11.16 |
| CVE-2021-35414 | 9.8 | Dec 3 | Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php Affected: 1.11.0 through 1.11.16 |
| CVE-2019-13082 | 9.8 | Jun 30 | Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature Affected: 1.11.8 |
| CVE-2018-1999019 | 9.8 | Jul 23 | Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in… Affected: 1.11.0; 1.11.0; 1.11.0; 1.11.0; 1.11.0; 1.11.0; +14 more |
| CVE-2026-39878 | 9.3 | Jul 20 | Chamilo stored XSS via user registration leads to admin account takeover Affected: <= 1.11.38 |
| CVE-2025-50199 | 9.1 | Mar 2 | Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF) Affected: < 1.11.30 |
| CVE-2026-45143 | 9.0 | Sep 17 | Chamilo LMS: Student-to-admin stored XSS in private messages via v-html Affected: >= 2.0.0, < 2.0.1 |
| CVE-2025-59543 | 9.0 | Mar 6 | Chamilo: Account Takeover via Stored XSS in Course Description Affected: < 1.11.34 |
| CVE-2025-59542 | 9.0 | Mar 6 | Chamilo: Account Takeover via Stored XSS in Course Learning Paths Affected: < 1.11.34 |
| CVE-2025-55289 | 9.0 | Mar 6 | Chamilo: Stored Cross Site Scripting in Skills Argumentation Affected: < 1.11.34 |
| CVE-2025-55208 | 9.0 | Mar 5 | Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files Affected: < 1.11.34 |
Showing 20