Chamilo vulnerabilities
97 CVEs and advisories name Chamilo as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-50199Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)
- CVE-2025-52563Chamilo: Reflected XSS via page parameter
- CVE-2025-52475Chamilo: Reflected XSS via keyword_inactive parameter
- CVE-2025-52476Chamilo: Reflected XSS via keyword_active parameter
- CVE-2025-52470Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name
- CVE-2025-52469Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass
- CVE-2025-52468Chamilo: Stored XSS Vulnerability via CSV User Import
- CVE-2025-50198Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters
- CVE-2025-50197Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter
- CVE-2025-50196Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter
- CVE-2025-50195Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php
- CVE-2025-50194Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php
- CVE-2025-50193Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter
- CVE-2025-50192Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php
- CVE-2025-50191Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script
- CVE-2025-50190Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script
- CVE-2025-50189Chamilo: Error-based SQL Injection
- CVE-2025-50188Error-based SQL Injection in Chamilo LMS
- CVE-2025-52482Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php
- CVE-2025-50187Chamilo: Evaluation of untrusted user input leads to Remote Code Execution
- CVE-2025-50186Chamilo: Stored XSS via Malicious CSV Filename in user_import.php
- CVE-2024-50337Chamilo: Potential unauthenticated blind SSRF via openid function
- CVE-2024-47886Chamilo: Post-Auth Remote Code Execution
- CVE-2018-25158Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder
- CVE-2026-1106Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization
- CVE-2023-4225Chamilo LMS File Upload Functionality Remote Code Execution
- CVE-2023-4226Chamilo LMS File Upload Functionality Remote Code Execution
- CVE-2023-4224Chamilo LMS File Upload Functionality Remote Code Execution
- CVE-2023-4223Chamilo LMS File Upload Functionality Remote Code Execution
- CVE-2023-4222Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability