Chamilo vulnerabilities
97 CVEs and advisories name Chamilo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33703Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens
- CVE-2026-33702Chamilo LMS has an Insecure Direct Object Reference (IDOR)
- CVE-2026-33698Chamilo LMS affected by unauthenticated RCE in main/install folder
- CVE-2026-33618Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
- CVE-2026-33141Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
- CVE-2026-32892OS Command Injection in Chamilo LMS 1.11.36
- CVE-2026-32932Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit
- CVE-2026-32931Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE
- CVE-2026-32930Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check
- CVE-2026-32894Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result
- CVE-2026-32893Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination
- CVE-2026-31941Server-Side Request Forgery (SSRF) in Chamilo LMS
- CVE-2026-31940Session Fixation in Chamilo LMS
- CVE-2026-31939Path Traversal (Arbitrary File Delete) in Chamilo LMS
- CVE-2025-66447Chamilo LMS has validation-less redirect on login page
- CVE-2026-30882Chamilo LMS: Reflected XSS in the session category listing page
- CVE-2026-30881Chamilo LMS: SQL Injection in the statistics AJAX endpoint
- CVE-2026-30876Chamilo LMS: User enumeration vulnerability via response
- CVE-2026-30875Chamilo LMS: Authenticated RCE via H5P Import
- CVE-2026-28430Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php
- CVE-2026-29041Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload
- CVE-2025-59544Chamilo: Unauthorized access to update category of any user
- CVE-2025-59543Chamilo: Account Takeover via Stored XSS in Course Description
- CVE-2025-59542Chamilo: Account Takeover via Stored XSS in Course Learning Paths
- CVE-2025-59541Chamilo: CSRF Vulnerability in Project Deletion
- CVE-2025-59540Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback
- CVE-2025-55289Chamilo: Stored Cross Site Scripting in Skills Argumentation
- CVE-2025-55208Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files
- CVE-2025-52564Chamilo: HTML injection via open parameter
- CVE-2025-52998Chamilo: PHAR deserialization bypass