CVE-2025-50190

CVE-2025-50190 affects Chamilo LMS (pre-1.11.30) via an error-based SQL injection in the index.php script, triggered by the GET parameter openid.assoc_handle. Public sources confirm vulnerable versions prior to 1.11.30 and indicate a patch in 1.11.30. Connected reports (CNVD/CIRCL/NVD/OSV, etc.) ...

CVE-2026-33708

Chamilo LMS exposes PII via the get_user_info_from_username REST endpoint before version 1.11.38. Any authenticated user (including students) can retrieve another user’s email, first name, last name, user ID, and active status due to missing authorization checks. This has been fixed in 1.11.38. R...

CVE-2026-34602

Chamilo LMS is affected by an IDOR in the /api/course_rel_users endpoint prior to version 2.0.0-RC.3. An authenticated attacker can modify the user parameter in the request body to enroll arbitrary users into courses without proper authorization checks, bypassing enrollment controls and potential...

CVE-2025-59544

Chamilo LMS prior to v1.11.34 contained an authorization bypass in the category_id parameter that allowed updating any user’s category without checks. The issue affects the user category update functionality and was fixed in v1.11.34. CVSS 4.0 base score 6.9 (MEDIUM) with NETWORK attack vector an...

CVE-2026-29041

Chamilo LMS is affected prior to version 1.11.34 by an authenticated remote code execution flaw due to inadequate validation of uploaded files. The system relies on MIME-type checks and does not properly validate file extensions or enforce safe storage, allowing an authenticated low-privileged us...

CVE-2026-33715

Chamilo LMS “CVE-2026-33715” affects version 2.0-RC.2 where public/main/inc/ajax/install.ajax.php is accessible without authentication, bypassing global.inc.php authentication and installation-completed checks. The test_mailer action accepts an arbitrary Symfony Mailer DSN from POST data and uses...

CVE-2025-50191

Chamilo LMS is affected by an error-based SQL injection in the /main/exercise/hotpotatoes.php script via POST to userFile, exploitable on versions prior to 1.11.30. The vulnerability allows an attacker to impact confidentiality and availability (HIGH severity per CVSS 4.0 metrics), with attack ve...

CVE-2026-32930

Chamilo LMS -- IDOR in the gradebook evaluation edit page affects prior to 1.11.38 and 2.0.0-RC.3. Authenticated teachers could view and modify evaluation settings (name, max score, weight) for other courses by manipulating the editeval GET parameter. The issue is fixed in 1.11.38 and 2.0.0-RC.3....

CVE-2026-33705

CVE-2026-33705 affects Chamilo LMS. Prior to 1.11.38, Twig template files under /main/template/default/ were accessible without authentication via HTTP GET, exposing internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. The issue is fixed in 1.11.38. Reported ...

CVE-2025-50194

CVE-2025-50194 affects Chamilo LMS prior to 1.11.30, with an OS Command Injection vulnerability in the /main/cron/lang/check_parse_lang.php module. The underlying issue allows an attacker to influence command execution within the affected environment, enabling potential remote impact as described...

CVE-2025-52482

CVE-2025-52482 affects Chamilo LMS prior to version 1.11.30, with a stored XSS vulnerability in the glossary function. The issue allows users with the Teachers role to inject JavaScript against the administrator via the glossary/trigger paths (e.g., /main/glossary/index.php and related tracking r...

CVE-2026-33141

Chamilo LMS contains an IDOR in the REST API stats endpoint (CVE-2026-33141). Prior to version 2.0.0-RC.3, any authenticated user (including ROLE_USER) could read another user’s learning progress, certificates, and gradebook scores for any course without enrollment or supervisory relationship. Th...

CVE-2025-69581

Chamilo LMS version 1.11.2 is vulnerable to an information disclosure flaw because the Social Network /personal_data endpoint lacks proper cache-control headers. This allows sensitive user information to remain accessible even after logout; by using the browser's back button , unauthorized users ...

CVE-2026-33736

Chamilo LMS prior to version 2.0.0-RC.3 is affected by an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user (including ROLE_STUDENT) to enumerate all platform users and retrieve personal information (email, phone, roles) via GET /api/users, potentially expos...

CVE-2026-33706

Chamilo LMS prior to 1.11.38 contains a privilege escalation via the REST API. An authenticated user with a REST API key can modify their own status through the update_user_from_username endpoint, allowing a student (status=5) to elevate to Teacher/CourseManager (status=1) and obtain course creat...

CVE-2026-34161

Technical details are not publicly available in the provided connected documents. Monitor for updates from Chamilo LMS advisory and subsequent CVE details.

CVE-2025-52475

CVE-2025-52475 affects Chamilo LMS before 1.11.30. A reflected XSS exists in the admin/user_list.php endpoint where the keyword_inactive parameter is not properly sanitized, allowing an attacker to inject JavaScript via a crafted URL. The issue is patched in version 1.11.30. No exploitation detai...

CVE-2025-55289

Chamilo LMS has a stored XSS vulnerability in the social network and internal messaging features present in versions prior to 1.11.34. The issue allows an attacker to inject arbitrary JavaScript that executes in the browser of an authenticated user (including administrators) when viewing the inje...

CVE-2026-33618

Chamilo LMS is affected by CVE-2026-33618. Prior to 2.0.0-RC.3, PlatformConfigurationController::decodeSettingArray() uses PHP eval() to parse settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into settings, which is executed when ...

CVE-2026-30882

Chamilo LMS (versions ...). The issue is triggered when pagination controls render (more than 20 session categories). A fix is available in version 1.11.36, which patches this vulnerability. If you cannot upgrade, apply an input sanitization/encoding workaround for the affected parameter and revi...

CVE-2026-31939

Chamilo LMS prior to 1.11.38 is affected by a path traversal vulnerability in main/exercise/savescores.php that allows arbitrary file deletion via user input from $_REQUEST['test'], concatenated into a filesystem path without canonicalization or traversal checks. The issue is fixed in version 1.1...

CVE-2026-30876

Chamilo LMS before version 1.11.36 is vulnerable to user enumeration via login response (valid vs invalid usernames). The issue has been fixed in 1.11.36. CVSS‑4.0 metrics indicate Network attack vector, Low confidentiality impact, and a Medium overall severity (6.3).