Vulnerabilities in Chamilo

88 results
Vexday analysis

Chamilo acumula 14 vulnerabilidades no histórico, com 3 classificadas como críticas, predominantemente relacionadas a upload de arquivos (CWE-434); apesar disso, nenhuma está sob exploração ativa conhecida no momento, e não há registros recentes que indiquem escalation do risco nos últimos três meses.

CVE-2026-34160HIGHChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata servicesEPSS 0.3%CVE-2025-50198HIGHChamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parametersEPSS 0.3%CVE-2026-45143CRITICALChamilo LMS: Student-to-admin stored XSS in private messages via v-htmlEPSS 0.3%CVE-2026-28430CRITICALChamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpEPSS 0.3%CVE-2024-50337MEDIUMChamilo: Potential unauthenticated blind SSRF via openid functionEPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2026-33618HIGHChamilo LMS Affected by Remote Code Execution via eval() in Platform SettingsEPSS 0.3%CVE-2026-40291HIGHChamilo LMS has Privilege Escalation via API User Role ModificationEPSS 0.3%CVE-2025-55208CRITICALChamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded FilesEPSS 0.3%CVE-2025-55289HIGHChamilo: Stored Cross Site Scripting in Skills ArgumentationEPSS 0.3%CVE-2025-59542CRITICALChamilo: Account Takeover via Stored XSS in Course Learning PathsEPSS 0.3%CVE-2025-50186MEDIUMChamilo: Stored XSS via Malicious CSV Filename in user_import.phpEPSS 0.3%CVE-2026-34239HIGHChamilo Authenticated Remote Code ExecutionEPSS 0.3%CVE-2025-52469HIGHChamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation BypassEPSS 0.3%CVE-2026-33710HIGHChamilo LMS has Weak REST API Key Generation (Predictable)EPSS 0.3%CVE-2026-32894HIGHChamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade ResultEPSS 0.3%CVE-2026-30881HIGHChamilo LMS: SQL Injection in the statistics AJAX endpointEPSS 0.3%CVE-2026-82535MEDIUMChamilo LMS Stored XSS via Survey Answer Submission in reporting.phpEPSS 0.3%CVE-2026-33714HIGHChamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)EPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%