Vulnerabilidades em chamilo
85 resultadosAnálise Vexday
Com 69 CVEs catalogadas e 31 surgidas apenas nos últimos 90 dias, o Chamilo apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção contínua. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tende a indicar superfície de ataque persistente em aplicações web com geração de conteúdo dinâmico. Nenhuma CVE consta no catálogo CISA KEV, taxa abaixo da média geral do catálogo, e o maior EPSS observado é 0.0275 — incluindo o da CVE-2025-50196, apontada como a mais perigosa no momento —, o que sugere probabilidade de exploração ainda baixa no curto prazo. Ainda assim, a presença de 8 falhas críticas e 1 PoC pública disponível reforça a necessidade de manter ciclos de atualização ágeis nesta plataforma.
CVE-2023-4220HIGHChamilo LMS Unauthenticated Big Upload File Remote Code ExecutionEPSS 76.1%CVE-2023-3368CRITICALChamilo LMS Unauthenticated Command InjectionEPSS 68.9%CVE-2023-4221HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2023-4222HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2025-50196HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameterEPSS 2.7%CVE-2023-3533CRITICALChamilo LMS Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 2.7%CVE-2025-50197HIGHChamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameterEPSS 2.7%CVE-2025-50195HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.phpEPSS 2.7%CVE-2025-50193HIGHChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterEPSS 2.6%CVE-2025-50194HIGHChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpEPSS 2.6%CVE-2023-4226HIGHChamilo LMS File Upload Functionality Remote Code ExecutionEPSS 2.4%CVE-2023-3545CRITICALChamilo LMS Htaccess File Upload Security BypassEPSS 2.0%CVE-2023-4223HIGHChamilo LMS File Upload Functionality Remote Code ExecutionEPSS 1.8%CVE-2023-4225HIGHChamilo LMS File Upload Functionality Remote Code ExecutionEPSS 1.8%CVE-2023-4224HIGHChamilo LMS File Upload Functionality Remote Code ExecutionEPSS 1.8%CVE-2026-35196HIGHChamilo LMS has OS Command Injection via export_all_certificates actionEPSS 1.8%CVE-2026-32892CRITICALOS Command Injection in Chamilo LMS 1.11.36EPSS 1.5%CVE-2024-47886HIGHChamilo: Post-Auth Remote Code ExecutionEPSS 0.9%CVE-2025-50187CRITICALChamilo: Evaluation of untrusted user input leads to Remote Code ExecutionEPSS 0.9%CVE-2013-0738—Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.EPSS 0.8%