CVE-2023-4220-Chamilo-LMS

Chamilo LMS Unauthenticated Big Upload File RCE PoC This script allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependencies using pip...

CVE-2023-4220_Chamilo_RCE

CVE-2023-4220 Python exploit for Chamilo Unrestricted File Upload Vuln - CVE-2023-4220 The code contained within the repository is meant for educational purposes only. Description: Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in...

Chamilo-CVE-2023-4220-Exploit

Chamilo-LMS-CVE-2023-4220-Exploit This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24, and Attackers can obtain remote code execution via uploading of web...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

CVE-2026-45141

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2023-4220-PoC

CVE-2023-4220 Arbitrary File Upload / RCE - PoC I created this script to automate the exploitation of CVE-2023-4220 and obtain a reverse shell on the Hack The Box PermX machine. This vulneraibilitie affects Chamilo LMS versions ≤ 1.11.24 , due to insufficient validation in the big upload...

EUVD-2026-113999

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

CVE-2026-44344

The Chamilo LMS learning management system is vulnerable to arbitrary PHP code execution in versions 1.x before 1.11.40 and 2.x before 2.0.1 . The root cause is the use of eval() calls within the vendored PEAR HTML_QuickForm libraries, which can be triggered if form element names contain attacker...

CVE-2026-44344 Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

EUVD-2026-113998

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

CVE-2026-45141

Chamilo LMS, an open-source learning management system, is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 2.0.1 . The vulnerability exists because the add, delete_gradebook_from_skill, save_profile, and delete_profile actions within public/main/inc/ajax/skill.ajax.php perfor...

CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

EUVD-2026-113997

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2026-45145

The open-source learning management system Chamilo LMS is vulnerable to a database-backed PHP object injection in its career deserialization process. Specifically, the files public/main/inc/lib/career.lib.php and public/main/cron/import_csv.php call PHP's native unserialize() on the user_career.e...

CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2026-45144

The Chamilo LMS learning management system (versions 2.0.0 through 2.0.1 ) contains a Stored XSS vulnerability within public user-profile fields. The root cause is the lack of server-side sanitization on the write path for six editable fields (firstname, lastname, competences, openarea, teach, an...