CVE-2023-4225

Chamilo LMS

CVE-2020-23128

CVE-2020-23128 affects Chamilo LMS 1.11.10. The issue is improper privilege management: a user with Sessions administrator privileges can create a new user and then use the Edit User function to grant that user administrator privileges. The connected sources consistently describe this as a privil...

CVE-2026-33707

Chamilo LMS (affected: prior to 1.11.38 and 2.0.0-RC.3) uses a weak password reset token by generating tokens as sha1(email) with no randomness, no expiration, and no rate limiting. An attacker who knows a user’s email can compute the reset token and change the password without authentication. Th...

CVE-2025-59542

Chamilo LMS prior to version 1.11.34 is affected by a stored XSS vulnerability in the course learning path Settings field. A low-privileged user (e.g., trainer) can inject JavaScript that executes in other users’ contexts (including admins), enabling exfiltration of session cookies or tokens and ...

CVE-2025-59543

CVE-2025-59543 describes a stored XSS in Chamilo LMS prior to version 1.11.34. An attacker with a low-privilege account (e.g., trainer) can inject malicious JavaScript into the course description, which executes in other users’ browsers (including admins) and can exfiltrate session cookies/tokens...

CVE-2026-32932

Chamilo LMS (affected versions: < 1.11.38 and

CVE-2025-50198

CVE-2025-50198 affects Chamilo before version 1.11.30. The vulnerability is a deserialization of untrusted data in /plugin/vchamilo/views/import.php triggered via POST parameters (configuration_file, course_path, home_path). The issue is addressed in Chamilo 1.11.30. According to the provided met...

CVE-2026-33703

CVE-2026-33703 affects Chamilo LMS prior to version 2.0.0-RC.3. An Insecure Direct Object Reference (IDOR) vulnerability exists in the /social-network/personal-data/{userId} endpoint, allowing any authenticated user to access full personal data and API tokens of arbitrary users by altering the us...

CVE-2025-66447

CVE-2025-66447 affects Chamilo LMS versions 1.11.0 through 2.0-beta.1, where an attacker can trigger a malicious redirect on the login page via the redirect parameter. The issue is addressed in 2.0-beta.2. Public sources (NVD/Red Hat/others) describe a login-page redirect vulnerability with a fix...

CVE-2026-1106

Chamilo LMS up to 2.0.0 Beta 1 is affected by a vulnerability in the Legal Consent Handler, specifically the deleteLegal function in src/CoreBundle/Controller/SocialController.php. According to the documents, manipulating the userId argument yields improper authorization, and the issue can be exp...

CVE-2026-32892

CVE-2026-32892 affects Chamilo LMS before 1.11.38 and 2.0.0-RC.3. The vulnerability is an OS command injection in the move() function of fileManage.lib.php, where user-controlled path values are concatenated into shell commands (e.g., exec("mv $source $target")) without escaping. The move_to POST...

CVE-2025-50187

CVE-2025-50187 affects Chamilo LMS. Prior to version 1.11.28, input from a SOAP request is evaluated without proper filtering, allowing Remote Code Execution via untrusted user input in the affected parameter. The vulnerability is rated with a high/critical impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/...

CVE-2026-33698

Chamilo LMS prior to 1.11.38 is vulnerable to a chained attack that can enable otherwise-blocked PHP code from the main/install/ directory, allowing an unauthenticated attacker to modify existing files or create new files where permitted by system permissions. The issue affects portals where main...

CVE-2025-50186

Chamilo LMS prior to version 1.11.30 is affected by a stored XSS vulnerability in CSV filenames. The issue arises from insufficient sanitization of uploaded CSV names, allowing an attacker to upload a file such as .csv that can execute JavaScript when viewed by administrators or users with access...

CVE-2025-50192

CVE-2025-50192 affects Chamilo LMS prior to version 1.11.30. A time-based SQL injection exists in the SOAP web service endpoint at /main/webservices/registration.soap.php , arising from insufficient validation of XML object sequences. The vulnerability is fixed in Chamilo 1.11.30 . Multiple conne...

CVE-2026-30875

Chamilo LMS (prior to v1.11.36) exposes an authenticated RCE via H5P Import. An attacker with Teacher role can upload a crafted H5P package that bypasses validation (H5P package validation only checks for h5p.json and does not block .htaccess or PHP files with alternate extensions), enabling exec...

CVE-2026-34160

Chamilo LMS prior to 2.0.0-RC.3 is affected. The PENS plugin endpoint at public/plugin/Pens/pens.php allows unauthenticated access and accepts a user-controlled package-url that is fetched via curl without filtering private/internal IPs, enabling unauthenticated SSRF. Impact includes probing inte...

CVE-2025-50193

CVE-2025-50193 affects Chamilo LMS prior to version 1.11.30. The vulnerability is an OS command injection in the file /plugin/vchamilo/views/import.php triggered by the POST parameter to_main_database , potentially enabling a remote attacker to execute arbitrary commands (and, per PT-2025-37308, ...

CVE-2025-52470

CVE-2025-52470 affects Chamilo LMS prior to version 1.11.30. It is a stored XSS vulnerability in session_category_add.php where improper sanitization of the Category Name allows privileged users to inject persistent JavaScript payloads. The injected script can execute when administrators access a...

CVE-2025-59540

CVE-2025-59540 affects Chamilo LMS prior to version 1.11.34. A stored cross-site scripting (XSS) vulnerability exists in the feedback input on the exercise history page, where unencoded input can be stored in the database and later rendered, enabling arbitrary JavaScript execution in the browser ...

CVE-2025-59544

Chamilo LMS prior to v1.11.34 contained an authorization bypass in the category_id parameter that allowed updating any user’s category without checks. The issue affects the user category update functionality and was fixed in v1.11.34. CVSS 4.0 base score 6.9 (MEDIUM) with NETWORK attack vector an...

CVE-2026-31940

CVE-2026-31940 affects Chamilo LMS prior to versions 1.11.38 and 2.0.0-RC.3. In the affected code path main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before the global bootstrap loads, enabling session fixation. The vulnerability arises from ...

CVE-2026-32894

CVE-2026-32894 affects Chamilo LMS. Affected: gradebook result view in Chamilo before 1.11.38 and 2.0.0-RC.3. Issue: Insecure Direct Object Reference (IDOR) allows any authenticated teacher to delete any student’s grade result across the platform by manipulating delete_mark or resultdelete GET pa...

CVE-2026-32931

CVE-2026-32931: Chamilo LMS has an unrestricted file upload vulnerability in the exercise sound upload function. Before versions 1.11.38 and 2.0.0-RC.3, an authenticated teacher could spoof Content-Type to audio/mpeg, upload a PHP webshell with its original .php extension into a web-accessible di...

CVE-2026-33141

Chamilo LMS contains an IDOR in the REST API stats endpoint (CVE-2026-33141). Prior to version 2.0.0-RC.3, any authenticated user (including ROLE_USER) could read another user’s learning progress, certificates, and gradebook scores for any course without enrollment or supervisory relationship. Th...

CVE-2026-33714

Chamilo LMS versions 2.0.0-RC.2 are affected by a SQL injection in the statistics AJAX endpoint (public/main/inc/ajax/statistics.ajax.php) where unsanitized parameters date_start and date_end in the users_active action interpolate into SQL. This follows an incomplete fix for CVE-2026-30881, which...

CVE-2026-33715

Chamilo LMS “CVE-2026-33715” affects version 2.0-RC.2 where public/main/inc/ajax/install.ajax.php is accessible without authentication, bypassing global.inc.php authentication and installation-completed checks. The test_mailer action accepts an arbitrary Symfony Mailer DSN from POST data and uses...

CVE-2026-33736

Chamilo LMS prior to version 2.0.0-RC.3 is affected by an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user (including ROLE_STUDENT) to enumerate all platform users and retrieve personal information (email, phone, roles) via GET /api/users, potentially expos...

CVE-2024-47886

CVE-2024-47886 affects Chamilo (LMS). A post-authentication phar unserialize bug in the virtualization plugin (vchamilo) allows an administrator to execute arbitrary code on the server, via features exposed by the plugin, in versions 1.11.12–1.11.26. The issue is mitigated by upgrading to version...

CVE-2025-50189

Chamilo LMS prior to 1.11.30 is vulnerable to an error-based SQL injection arising from insufficient validation of user-supplied data in POST resource[document][SQL_INJECTION_HERE] and in POST login parameters at /main/coursecopy/copy_course_session_selected.php. The vulnerability can allow an at...

CVE-2025-52468

Chamilo LMS contains a stored XSS vulnerability (CVE-2025-52468) in CSV user imports prior to v1.11.30, due to insufficient sanitization in Last Name, First Name, and Username fields. The stored payload is triggered when a user profile is viewed in the context of the authenticated user. Patch rel...

CVE-2025-52469

Chamilo LMS prior to version 1.11.30 contains a logic vulnerability in the social network/ friend-request workflow that allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint, bypassing normal send/accept flows and even adding non-existent users. T...

CVE-2025-52563

Chamilo (LMS) is affected by a reflected XSS vulnerability in the session/add_users_to_session.php endpoint caused by insufficient sanitization of the page parameter. The issue exists before version 1.11.30 and is patched in v1.11.30. Evidence across sources (CVE-2025-52563) confirms the vulnerab...

CVE-2025-52998

Summary: CVE-2025-52998 affects Chamilo LMS components prior to version 1.11.30, where PHAR deserialization could be manipulated by crafting objects to spoof data and modify application logic. What’s affected: Chamilo, prior to 1.11.30. The root cause is flaws in the deserialization mechanism (PH...

CVE-2025-55208

Summary: CVE-2025-55208 affects Chamilo LMS prior to 1.11.34. A Stored XSS via insecure file uploads in the Social Networks feature allows a low-privilege user to execute arbitrary code in the admin inbox, enabling admin account takeover. The issue is fixed in version 1.11.34. The provided metric...

CVE-2026-28430

Chamilo LMS is affected by an unauthenticated SQL injection in the chamiko-lms model.ajax.php component prior to version 1.11.34, exploitable via the custom_dates parameter. Successful exploitation can lead to full administrative account takeover and access to the entire database (including PII a...

CVE-2026-30881

Chamilo LMS (versions

CVE-2026-32930

Chamilo LMS -- IDOR in the gradebook evaluation edit page affects prior to 1.11.38 and 2.0.0-RC.3. Authenticated teachers could view and modify evaluation settings (name, max score, weight) for other courses by manipulating the editeval GET parameter. The issue is fixed in 1.11.38 and 2.0.0-RC.3....

CVE-2026-33702

Chamilo LMS before 1.11.38 and 2.0.0-RC.3 contains an IDOR in lp_ajax_save_item.php where a uid is read from $_REQUEST and used to load/modify another user’s Learning Path progress (score, status, completion, time) without verifying the requester’s identity. Any authenticated course-enrolled user...

CVE-2024-50337

CVE-2024-50337 affects Chamilo LMS prior to version 1.11.28, where the OpenId function allows unauthenticated requests to arbitrary URLs on the server, resulting in unauthenticated blind SSRF. Multiple sources (NVD, Red Hat advisory, CVE records) confirm the issue and its patch in 1.11.28. Affect...

CVE-2025-50191

Chamilo LMS is affected by an error-based SQL injection in the /main/exercise/hotpotatoes.php script via POST to userFile, exploitable on versions prior to 1.11.30. The vulnerability allows an attacker to impact confidentiality and availability (HIGH severity per CVSS 4.0 metrics), with attack ve...

CVE-2025-50197

Chamilo LMS prior to 1.11.30 has an OS Command Injection in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. Exploitation could allow arbitrary command execution on the server. It is fixed in version 1.11.30 . CVSS v4 base score 7.1 (HIGH); attack vector: NETWORK, privil...

CVE-2025-52476

CVE-2025-52476 affects Chamilo LMS prior to version 1.11.30. The vulnerability is a reflected cross-site scripting (XSS) flaw caused by improper sanitization of the keyword_active parameter in admin/user_list.php. The issue is mitigated by upgrading to version 1.11.30, which patches the vulnerabi...

CVE-2025-52564

Chamilo LMS before 1.11.30 is affected by an HTML injection vulnerability in the open parameter of help.php, allowing a crafted URL to inject arbitrary HTML. The underlying issue is insufficient sanitization of user input. The flaw has been fixed in version 1.11.30. Affected product: Chamilo LMS;...

CVE-2026-33704

CVE-2026-33704 affects Chamilo LMS prior to version 1.11.38. An authenticated user (including students) can use the BigUpload endpoint to write arbitrary content to server files: the key parameter selects the filename and the raw POST body becomes the file contents. Although .php extensions are f...

CVE-2026-33710

Chamilo LMS (prior to 1.11.38 and 2.0.0-RC.3) uses REST API keys generated by md5(time() + (user_id * 5) - rand(10000, 10000)). Since rand(10000,10000) always returns 10000, the key becomes md5(timestamp + user_id*5 - 10000), enabling brute-forcing by an attacker who knows a username and approxim...

CVE-2026-34602

Chamilo LMS is affected by an IDOR in the /api/course_rel_users endpoint prior to version 2.0.0-RC.3. An authenticated attacker can modify the user parameter in the request body to enroll arbitrary users into courses without proper authorization checks, bypassing enrollment controls and potential...

CVE-2026-35196

Chamilo LMS vulnerable to OS Command Injection prior to 2.0.0-RC.3. The flaw resides in the gradebook.ajax.php endpoint (export_all_certificates action), where the course code is taken from $_SESSION['_cid'] via api_get_course_id() and concatenated into a shell_exec() command without sanitization...

CVE-2025-50195

CVE-2025-50195 affects the Chamilo learning management system. A vulnerability in the file /plugin/vchamilo/views/manage.controller.php allows an OS Command Injection on Chamilo installations running versions prior to 1.11.30 . The issue has been addressed in Chamilo release 1.11.30 (patch/commit...

CVE-2025-59541

CVE-2025-59541 (Chamilo LMS) : Prior to 1.11.34, a CSRF vulnerability allows an authenticated trainer to delete projects within a course by visiting a malicious page, due to missing anti-CSRF protections and reliance on GET requests. The issue enables unauthorized project deletion with high impac...