CVE-2025-50191

Chamilo LMS is affected by an error-based SQL injection in the /main/exercise/hotpotatoes.php script via POST to userFile, exploitable on versions prior to 1.11.30. The vulnerability allows an attacker to impact confidentiality and availability (HIGH severity per CVSS 4.0 metrics), with attack ve...