CVE-2026-33703

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference IDOR vulnerability in the /social-network/personal-data/userId endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId...

CVE-2026-33703

CVE-2026-33703 affects Chamilo LMS prior to version 2.0.0-RC.3. An Insecure Direct Object Reference (IDOR) vulnerability exists in the /social-network/personal-data/{userId} endpoint, allowing any authenticated user to access full personal data and API tokens of arbitrary users by altering the us...

PT-2026-32016

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3 Description Chamilo LMS, a learning management system, contains an Insecure Direct Object Reference IDOR vulnerability in the /social-network/personal-data/userId API endpoint. An authenticated user can...

Chamilo LMS 安全漏洞

Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Versions of Chamilo LMS prior to 2.0.0-RC.3 contained security vulnerabilities. These vulnerabilities stemmed fr...

EUVD-2026-20341

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through = 1.7.0...

CVE-2026-27787

MATCHA SNS contains a cross-site scripting vulnerability (CVE-2026-27787) affecting version 1.3.9 and earlier. The root cause is an XSS flaw that could allow arbitrary script execution in a user’s browser when visiting a compromised page. Public sources in connected documents confirm affected ver...

CVE-2026-33615

creationtimestamp| type| source ---|---|--- 2026-04-02 09:04:05+00:00| seen| https://infosec.exchange/users/certvde/statuses/116334306568810530 2026-04-02 09:04:13+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3miitxsrop2j2 2026-04-02 11:20:58+00:00| seen|...

CVE-2026-5321

creationtimestamp| type| source ---|---|--- 2026-04-02 06:21:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miikuiyug32z...

Code-Projects Social Networking Site SQL注入漏洞

Code-Projects Social Networking Site is an open-source social networking site developed by Code-Projects. Version 1.0 of Code-Projects Social Networking Site has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter ID in the file deletephotos.php, whic...

CVE-2019-25638

creationtimestamp| type| source ---|---|--- 2026-03-24 13:44:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhspgvfdks2x...

CVE-2015-20121

creationtimestamp| type| source ---|---|--- 2026-03-19 06:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhfd62svx723...

CVE-2025-55289 Chamilo: Stored Cross Site Scripting in Skills Argumentation

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS Verison 1.11.32 allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user includin...

PT-2026-23631

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34 Description Chamilo is a learning management system with a stored cross-site scripting XSS issue. The issue exists in the platform’s social network and internal messaging features. An attacker can inject...

CVE-2026-28405

creationtimestamp| type| source ---|---|--- 2026-03-05 21:59:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsamkleb24 2026-03-07 14:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghyguv3cj2c...

CVE-2025-55208 Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files

Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in Social Networks. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue...

CVE-2025-52469

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal fl...

CVE-2025-52469 Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal fl...

PT-2026-22616

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description Chamilo is a learning management system. A logic issue in the friend request workflow of Chamilo’s social network module allows an authenticated user to add any user as a friend by directly calling...

CVE-2026-28338

creationtimestamp| type| source ---|---|--- 2026-02-27 12:50:43+00:00| published-proof-of-concept| https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r 2026-02-27 23:18:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuttvuhhk2u 2026-02-28 04:10:10+00:00| seen|...

CVE-2026-2777

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:18+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevqoyme27 2026-02-28 02:01:54+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4yf4dfo2t...