Chamilo - vulnerabilities (CVEs)

158 CVEs in 5 products, 4 in the last 30 days, newest from 2026-10-21.

Products

• Chamilo Lms - 126 CVEs
• Chamilo-lms - 73 CVEs
• Chamilo - 27 CVEs
• Chamillo Lms - 1 CVEs
• Lms - 1 CVEs

Newest CVEs of Chamilo

• CVE-2026-114390 - CVSS 6.9 (medium), 2026-10-21: Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that…
• CVE-2026-114388 - CVSS 6.9 (medium), 2026-10-21: Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows…
• CVE-2026-114389 - CVSS 5.3 (medium), 2026-10-21: Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated…
• CVE-2026-112031 - CVSS 5.1 (medium), 2026-10-18: A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file…
• CVE-2026-45140 - CVSS 9.8 (critical), 2026-09-17: Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on…
• CVE-2026-45143 - CVSS 9 (critical), 2026-09-17: Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side…
• CVE-2026-82535 - CVSS 6.1 (medium), 2026-09-11: Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script…
• CVE-2026-34239 - CVSS 7.5 (high), 2026-07-20: Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected…
• CVE-2026-39878 - CVSS 9.3 (critical), 2026-07-20: Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated…
• CVE-2026-40291 - CVSS 8.8 (high), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT…
• CVE-2026-34602 - CVSS 7.1 (high), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct…
• CVE-2026-34370 - CVSS 6.5 (medium), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference…
• CVE-2026-35196 - CVSS 8.8 (high), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the…
• CVE-2026-34160 - CVSS 8.6 (high), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint…
• CVE-2026-33715 - CVSS 7.2 (high), 2026-04-14: Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without…
• CVE-2026-34161 - CVSS 5.4 (medium), 2026-04-14: Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the…
• CVE-2026-33714 - CVSS 7.2 (high), 2026-04-14: Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which…
• CVE-2026-33737 - CVSS 6.5 (medium), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With…
• CVE-2026-33736 - CVSS 6.5 (medium), 2026-04-10: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access…
• CVE-2026-33710 - CVSS 7.5 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000,…
• CVE-2026-33708 - CVSS 6.5 (medium), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first…
• CVE-2026-33698 - CVSS 9.8 (critical), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and…
• CVE-2026-33704 - CVSS 8.8 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server…
• CVE-2026-33707 - CVSS 9.8 (critical), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no…
• CVE-2026-33703 - CVSS 7.1 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the…
• CVE-2026-33706 - CVSS 7.1 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the…
• CVE-2026-33702 - CVSS 7.1 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in…
• CVE-2026-33705 - CVSS 5.3 (medium), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without…
• CVE-2026-33618 - CVSS 8.8 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse…
• CVE-2026-32894 - CVSS 7.1 (high), 2026-04-10: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result…