# cve.now: Chamilo

The newest entries naming Chamilo as an affected vendor (up to 200), of 97 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-45146](https://cve.now/CVE-2026-45146.md): Chamilo LMS: Blind SQL Injection in model.ajax.php via filters\[groupOp\] authentificated (CVSS 7.2)
- [CVE-2026-44344](https://cve.now/CVE-2026-44344.md): Chamilo LMS: Conditional PHP execution through vendored QuickForm eval (CVSS 6.6)
- [CVE-2026-45141](https://cve.now/CVE-2026-45141.md): Chamilo LMS: CSRF in destructive skill-management AJAX actions (CVSS 6.5)
- [CVE-2026-45145](https://cve.now/CVE-2026-45145.md): Chamilo LMS: Database-backed PHP object injection in career deserialization (CVSS 7.5)
- [CVE-2026-45144](https://cve.now/CVE-2026-45144.md): Chamilo LMS: Stored XSS in public user-profile fields (CVSS 8.9)
- [CVE-2026-114390](https://cve.now/CVE-2026-114390.md): Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers (CVSS 6.9)
- [CVE-2026-114389](https://cve.now/CVE-2026-114389.md): Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade (CVSS 5.3)
- [CVE-2026-114388](https://cve.now/CVE-2026-114388.md): Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController (CVSS 6.9)
- [CVE-2026-112031](https://cve.now/CVE-2026-112031.md): Chamilo LMS Ticket TicketManager.php addProject cross site scripting (CVSS 5.1)
- [CVE-2026-45140](https://cve.now/CVE-2026-45140.md): Chamilo LMS CStudio upload flow allows unauthenticated remote code execution (CVSS 9.8)
- [CVE-2026-45143](https://cve.now/CVE-2026-45143.md): Chamilo LMS: Student-to-admin stored XSS in private messages via v-html (CVSS 9.0)
- [CVE-2026-82535](https://cve.now/CVE-2026-82535.md): Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php (CVSS 5.3)
- [CVE-2026-34239](https://cve.now/CVE-2026-34239.md): Chamilo Authenticated Remote Code Execution (CVSS 7.5)
- [CVE-2026-39878](https://cve.now/CVE-2026-39878.md): Chamilo stored XSS via user registration leads to admin account takeover (CVSS 9.3)
- [CVE-2026-40291](https://cve.now/CVE-2026-40291.md): Chamilo LMS has Privilege Escalation via API User Role Modification (CVSS 8.8)
- [CVE-2026-35196](https://cve.now/CVE-2026-35196.md): Chamilo LMS has OS Command Injection via export\_all\_certificates action (CVSS 8.8)
- [CVE-2026-34602](https://cve.now/CVE-2026-34602.md): Chamilo LMS: IDOR in /api/course\_rel\_users Allows Unauthorized Enrollment of Arbitrary Users into Courses (CVSS 7.1)
- [CVE-2026-34370](https://cve.now/CVE-2026-34370.md): Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes (CVSS 6.5)
- [CVE-2026-34161](https://cve.now/CVE-2026-34161.md): Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution (CVSS 5.1)
- [CVE-2026-34160](https://cve.now/CVE-2026-34160.md): Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services (CVSS 8.6)
- [CVE-2026-33715](https://cve.now/CVE-2026-33715.md): Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test\_mailer action (CVSS 7.2)
- [CVE-2026-33714](https://cve.now/CVE-2026-33714.md): Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users\_active action (2.0 RC2) (CVSS 7.1)
- [CVE-2026-33737](https://cve.now/CVE-2026-33737.md): Chamilo LMS has an XML External Entity (XXE) Injection (CVSS 5.3)
- [CVE-2026-33736](https://cve.now/CVE-2026-33736.md): Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure (CVSS 6.5)
- [CVE-2026-33710](https://cve.now/CVE-2026-33710.md): Chamilo LMS has Weak REST API Key Generation (Predictable) (CVSS 7.5)
- [CVE-2026-33708](https://cve.now/CVE-2026-33708.md): Chamilo LMS has REST API PII Exposure via get\_user\_info\_from\_username (CVSS 6.5)
- [CVE-2026-33707](https://cve.now/CVE-2026-33707.md): Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms (CVSS 9.4)
- [CVE-2026-33706](https://cve.now/CVE-2026-33706.md): Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) (CVSS 7.1)
- [CVE-2026-33705](https://cve.now/CVE-2026-33705.md): Chamilo LMS has unauthenticated access to Twig template source files exposes application logic (CVSS 5.3)
- [CVE-2026-33704](https://cve.now/CVE-2026-33704.md): Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint (CVSS 7.1)
- [CVE-2026-33703](https://cve.now/CVE-2026-33703.md): Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens (CVSS 7.1)
- [CVE-2026-33702](https://cve.now/CVE-2026-33702.md): Chamilo LMS has an Insecure Direct Object Reference (IDOR) (CVSS 7.1)
- [CVE-2026-33698](https://cve.now/CVE-2026-33698.md): Chamilo LMS affected by unauthenticated RCE in main/install folder (CVSS 9.3)
- [CVE-2026-33618](https://cve.now/CVE-2026-33618.md): Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings (CVSS 8.8)
- [CVE-2026-33141](https://cve.now/CVE-2026-33141.md): Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data (CVSS 6.5)
- [CVE-2026-32892](https://cve.now/CVE-2026-32892.md): OS Command Injection in Chamilo LMS 1.11.36 (CVSS 9.1)
- [CVE-2026-32932](https://cve.now/CVE-2026-32932.md): Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit (CVSS 4.7)
- [CVE-2026-32931](https://cve.now/CVE-2026-32931.md): Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE (CVSS 7.5)
- [CVE-2026-32930](https://cve.now/CVE-2026-32930.md): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check (CVSS 7.1)
- [CVE-2026-32894](https://cve.now/CVE-2026-32894.md): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result (CVSS 7.1)
- [CVE-2026-32893](https://cve.now/CVE-2026-32893.md): Chamilo LMS has Reflected XSS via Unsanitized http\_build\_query() in Exercise Question List Pagination (CVSS 5.4)
- [CVE-2026-31941](https://cve.now/CVE-2026-31941.md): Server-Side Request Forgery (SSRF) in Chamilo LMS (CVSS 7.7)
- [CVE-2026-31940](https://cve.now/CVE-2026-31940.md): Session Fixation in Chamilo LMS (CVSS 7.5)
- [CVE-2026-31939](https://cve.now/CVE-2026-31939.md): Path Traversal (Arbitrary File Delete) in Chamilo LMS (CVSS 8.3)
- [CVE-2025-66447](https://cve.now/CVE-2025-66447.md): Chamilo LMS has validation-less redirect on login page (CVSS 0.0)
- [CVE-2026-30882](https://cve.now/CVE-2026-30882.md): Chamilo LMS: Reflected XSS in the session category listing page (CVSS 6.1)
- [CVE-2026-30881](https://cve.now/CVE-2026-30881.md): Chamilo LMS: SQL Injection in the statistics AJAX endpoint (CVSS 8.8)
- [CVE-2026-30876](https://cve.now/CVE-2026-30876.md): Chamilo LMS: User enumeration vulnerability via response (CVSS 6.3)
- [CVE-2026-30875](https://cve.now/CVE-2026-30875.md): Chamilo LMS: Authenticated RCE via H5P Import (CVSS 8.8)
- [CVE-2026-28430](https://cve.now/CVE-2026-28430.md): Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php (CVSS 9.3)
- [CVE-2026-29041](https://cve.now/CVE-2026-29041.md): Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload (CVSS 8.8)
- [CVE-2025-59544](https://cve.now/CVE-2025-59544.md): Chamilo: Unauthorized access to update category of any user (CVSS 6.9)
- [CVE-2025-59543](https://cve.now/CVE-2025-59543.md): Chamilo: Account Takeover via Stored XSS in Course Description (CVSS 9.1)
- [CVE-2025-59542](https://cve.now/CVE-2025-59542.md): Chamilo: Account Takeover via Stored XSS in Course Learning Paths (CVSS 9.1)
- [CVE-2025-59541](https://cve.now/CVE-2025-59541.md): Chamilo: CSRF Vulnerability in Project Deletion (CVSS 8.1)
- [CVE-2025-59540](https://cve.now/CVE-2025-59540.md): Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback (CVSS 6.4)
- [CVE-2025-55289](https://cve.now/CVE-2025-55289.md): Chamilo: Stored Cross Site Scripting in Skills Argumentation (CVSS 8.8)
- [CVE-2025-55208](https://cve.now/CVE-2025-55208.md): Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files (CVSS 9.1)
- [CVE-2025-52564](https://cve.now/CVE-2025-52564.md): Chamilo: HTML injection via open parameter (CVSS 6.9)
- [CVE-2025-52998](https://cve.now/CVE-2025-52998.md): Chamilo: PHAR deserialization bypass (CVSS 7.0)
- [CVE-2025-50199](https://cve.now/CVE-2025-50199.md): Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF) (CVSS 7.7)
- [CVE-2025-52563](https://cve.now/CVE-2025-52563.md): Chamilo: Reflected XSS via page parameter (CVSS 5.1)
- [CVE-2025-52475](https://cve.now/CVE-2025-52475.md): Chamilo: Reflected XSS via keyword\_inactive parameter (CVSS 5.1)
- [CVE-2025-52476](https://cve.now/CVE-2025-52476.md): Chamilo: Reflected XSS via keyword\_active parameter (CVSS 5.1)
- [CVE-2025-52470](https://cve.now/CVE-2025-52470.md): Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name (CVSS 4.8)
- [CVE-2025-52469](https://cve.now/CVE-2025-52469.md): Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass (CVSS 7.1)
- [CVE-2025-52468](https://cve.now/CVE-2025-52468.md): Chamilo: Stored XSS Vulnerability via CSV User Import (CVSS 8.8)
- [CVE-2025-50198](https://cve.now/CVE-2025-50198.md): Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration\_file; POST course\_path; POST home\_path parameters (CVSS 8.8)
- [CVE-2025-50197](https://cve.now/CVE-2025-50197.md): Chamilo: OS Command Injection in /main/admin/sub\_language\_ajax.inc.php via POST new\_language parameter (CVSS 7.1)
- [CVE-2025-50196](https://cve.now/CVE-2025-50196.md): Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main\_database parameter (CVSS 7.1)
- [CVE-2025-50195](https://cve.now/CVE-2025-50195.md): Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php (CVSS 7.1)
- [CVE-2025-50194](https://cve.now/CVE-2025-50194.md): Chamilo: OS Command Injection in /main/cron/lang/check\_parse\_lang.php (CVSS 7.1)
- [CVE-2025-50193](https://cve.now/CVE-2025-50193.md): Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to\_main\_database parameter (CVSS 7.1)
- [CVE-2025-50192](https://cve.now/CVE-2025-50192.md): Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php (CVSS 8.8)
- [CVE-2025-50191](https://cve.now/CVE-2025-50191.md): Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script (CVSS 7.0)
- [CVE-2025-50190](https://cve.now/CVE-2025-50190.md): Chamilo: Error-based SQL Injection via GET openid.assoc\_handle with the /index.php script (CVSS 8.8)
- [CVE-2025-50189](https://cve.now/CVE-2025-50189.md): Chamilo: Error-based SQL Injection (CVSS 7.2)
- [CVE-2025-50188](https://cve.now/CVE-2025-50188.md): Error-based SQL Injection in Chamilo LMS (CVSS 7.0)
- [CVE-2025-52482](https://cve.now/CVE-2025-52482.md): Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course\_log\_resources.php (CVSS 8.3)
- [CVE-2025-50187](https://cve.now/CVE-2025-50187.md): Chamilo: Evaluation of untrusted user input leads to Remote Code Execution (CVSS 9.8)
- [CVE-2025-50186](https://cve.now/CVE-2025-50186.md): Chamilo: Stored XSS via Malicious CSV Filename in user\_import.php (CVSS 4.8)
- [CVE-2024-50337](https://cve.now/CVE-2024-50337.md): Chamilo: Potential unauthenticated blind SSRF via openid function (CVSS 5.3)
- [CVE-2024-47886](https://cve.now/CVE-2024-47886.md): Chamilo: Post-Auth Remote Code Execution (CVSS 8.7)
- [CVE-2018-25158](https://cve.now/CVE-2018-25158.md): Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder (CVSS 8.7)
- [CVE-2026-1106](https://cve.now/CVE-2026-1106.md): Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization (CVSS 5.3)
- [CVE-2023-4225](https://cve.now/CVE-2023-4225.md): Chamilo LMS File Upload Functionality Remote Code Execution (CVSS 8.8)
- [CVE-2023-4226](https://cve.now/CVE-2023-4226.md): Chamilo LMS File Upload Functionality Remote Code Execution (CVSS 8.8)
- [CVE-2023-4224](https://cve.now/CVE-2023-4224.md): Chamilo LMS File Upload Functionality Remote Code Execution (CVSS 8.8)
- [CVE-2023-4223](https://cve.now/CVE-2023-4223.md): Chamilo LMS File Upload Functionality Remote Code Execution (CVSS 8.8)
- [CVE-2023-4222](https://cve.now/CVE-2023-4222.md): Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability (CVSS 7.2)
- [CVE-2023-4221](https://cve.now/CVE-2023-4221.md): Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability (CVSS 7.2)
- [CVE-2023-4220](https://cve.now/CVE-2023-4220.md): Chamilo LMS Unauthenticated Big Upload File Remote Code Execution (CVSS 8.1)
- [CVE-2023-3545](https://cve.now/CVE-2023-3545.md): Chamilo LMS Htaccess File Upload Security Bypass (CVSS 9.8)
- [CVE-2023-3533](https://cve.now/CVE-2023-3533.md): Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write (CVSS 9.8)
- [CVE-2023-3368](https://cve.now/CVE-2023-3368.md): Chamilo LMS Unauthenticated Command Injection (CVSS 9.8)
- [CVE-2013-0739](https://cve.now/CVE-2013-0739.md): Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. (no CVSS)
- [CVE-2013-0738](https://cve.now/CVE-2013-0738.md): Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/chamilo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.