Vulnerabilities in chamilo
97 resultsCVE-2026-33708MEDIUMChamilo LMS has REST API PII Exposure via get_user_info_from_usernameEPSS 0.2%CVE-2026-33715HIGHChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer actionEPSS 0.2%CVE-2026-30882MEDIUMChamilo LMS: Reflected XSS in the session category listing pageEPSS 0.2%CVE-2025-59540MEDIUMChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackEPSS 0.2%CVE-2026-34602HIGHChamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into CoursesEPSS 0.2%CVE-2025-59544MEDIUMChamilo: Unauthorized access to update category of any userEPSS 0.2%CVE-2026-32930HIGHChamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership CheckEPSS 0.2%CVE-2025-52563MEDIUMChamilo: Reflected XSS via page parameterEPSS 0.2%CVE-2026-32932MEDIUMChamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course EditEPSS 0.2%CVE-2025-59541HIGHChamilo: CSRF Vulnerability in Project DeletionEPSS 0.2%CVE-2026-33703HIGHChamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API TokensEPSS 0.2%CVE-2026-45141MEDIUMChamilo LMS: CSRF in destructive skill-management AJAX actionsEPSS 0.2%CVE-2026-33706HIGHChamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)EPSS 0.2%CVE-2026-114388MEDIUMChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookControllerEPSS 0.2%CVE-2025-66447NONEChamilo LMS has validation-less redirect on login pageEPSS 0.2%CVE-2026-32893MEDIUMChamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List PaginationEPSS 0.1%CVE-2026-33141MEDIUMChamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning DataEPSS 0.1%