Vulnerabilities in Chamilo
97 resultsCVE-2026-33704HIGHChamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointEPSS 0.4%CVE-2025-52468HIGHChamilo: Stored XSS Vulnerability via CSV User ImportEPSS 0.4%CVE-2025-50198HIGHChamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parametersEPSS 0.4%CVE-2024-50337MEDIUMChamilo: Potential unauthenticated blind SSRF via openid functionEPSS 0.4%CVE-2025-55208CRITICALChamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded FilesEPSS 0.4%CVE-2026-45145HIGHChamilo LMS: Database-backed PHP object injection in career deserializationEPSS 0.4%CVE-2025-50186MEDIUMChamilo: Stored XSS via Malicious CSV Filename in user_import.phpEPSS 0.4%CVE-2026-31939HIGHPath Traversal (Arbitrary File Delete) in Chamilo LMSEPSS 0.4%CVE-2026-28430CRITICALChamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpEPSS 0.3%CVE-2025-59542CRITICALChamilo: Account Takeover via Stored XSS in Course Learning PathsEPSS 0.3%CVE-2025-55289HIGHChamilo: Stored Cross Site Scripting in Skills ArgumentationEPSS 0.3%CVE-2026-34160HIGHChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata servicesEPSS 0.3%CVE-2026-44344MEDIUMChamilo LMS: Conditional PHP execution through vendored QuickForm evalEPSS 0.3%CVE-2025-52469HIGHChamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation BypassEPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2026-33618HIGHChamilo LMS Affected by Remote Code Execution via eval() in Platform SettingsEPSS 0.3%CVE-2026-45146HIGHChamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificatedEPSS 0.3%CVE-2026-40291HIGHChamilo LMS has Privilege Escalation via API User Role ModificationEPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%CVE-2026-30881HIGHChamilo LMS: SQL Injection in the statistics AJAX endpointEPSS 0.3%