Vulnerabilidades em Chamilo
97 resultadosAnálise Vexday
Chamilo acumula 14 vulnerabilidades no histórico, com 3 classificadas como críticas, predominantemente relacionadas a upload de arquivos (CWE-434); apesar disso, nenhuma está sob exploração ativa conhecida no momento, e não há registros recentes que indiquem escalation do risco nos últimos três meses.
CVE-2026-33710HIGHChamilo LMS has Weak REST API Key Generation (Predictable)EPSS 0.3%CVE-2026-32894HIGHChamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade ResultEPSS 0.3%CVE-2026-114389MEDIUMChamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGradeEPSS 0.3%CVE-2026-33714HIGHChamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)EPSS 0.3%CVE-2025-52470MEDIUMChamilo: Stored Cross-Site Scripting (XSS) via Session Category NameEPSS 0.3%CVE-2026-112031MEDIUMChamilo LMS Ticket TicketManager.php addProject cross site scriptingEPSS 0.3%CVE-2026-33705MEDIUMChamilo LMS has unauthenticated access to Twig template source files exposes application logicEPSS 0.2%CVE-2026-31940HIGHSession Fixation in Chamilo LMSEPSS 0.2%CVE-2026-33702HIGHChamilo LMS has an Insecure Direct Object Reference (IDOR)EPSS 0.2%CVE-2026-31941HIGHServer-Side Request Forgery (SSRF) in Chamilo LMSEPSS 0.2%CVE-2026-45144HIGHChamilo LMS: Stored XSS in public user-profile fieldsEPSS 0.2%CVE-2025-52564MEDIUMChamilo: HTML injection via open parameterEPSS 0.2%CVE-2026-114390MEDIUMChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX HandlersEPSS 0.2%CVE-2026-34370MEDIUMChamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notesEPSS 0.2%CVE-2025-52476MEDIUMChamilo: Reflected XSS via keyword_active parameterEPSS 0.2%CVE-2025-52475MEDIUMChamilo: Reflected XSS via keyword_inactive parameterEPSS 0.2%CVE-2026-33737MEDIUMChamilo LMS has an XML External Entity (XXE) InjectionEPSS 0.2%CVE-2026-34161MEDIUMChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript ExecutionEPSS 0.2%CVE-2026-30876MEDIUMChamilo LMS: User enumeration vulnerability via responseEPSS 0.2%CVE-2026-33736MEDIUMChamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data ExposureEPSS 0.2%