Vulnerabilidades em chamilo
88 resultadosAnálise Vexday
Com 69 CVEs catalogadas e 31 surgidas apenas nos últimos 90 dias, o Chamilo apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção contínua. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tende a indicar superfície de ataque persistente em aplicações web com geração de conteúdo dinâmico. Nenhuma CVE consta no catálogo CISA KEV, taxa abaixo da média geral do catálogo, e o maior EPSS observado é 0.0275 — incluindo o da CVE-2025-50196, apontada como a mais perigosa no momento —, o que sugere probabilidade de exploração ainda baixa no curto prazo. Ainda assim, a presença de 8 falhas críticas e 1 PoC pública disponível reforça a necessidade de manter ciclos de atualização ágeis nesta plataforma.
CVE-2026-31939HIGHPath Traversal (Arbitrary File Delete) in Chamilo LMSEPSS 0.4%CVE-2026-34160HIGHChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata servicesEPSS 0.3%CVE-2025-50198HIGHChamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parametersEPSS 0.3%CVE-2026-45143CRITICALChamilo LMS: Student-to-admin stored XSS in private messages via v-htmlEPSS 0.3%CVE-2026-28430CRITICALChamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpEPSS 0.3%CVE-2024-50337MEDIUMChamilo: Potential unauthenticated blind SSRF via openid functionEPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2026-33618HIGHChamilo LMS Affected by Remote Code Execution via eval() in Platform SettingsEPSS 0.3%CVE-2026-40291HIGHChamilo LMS has Privilege Escalation via API User Role ModificationEPSS 0.3%CVE-2025-55208CRITICALChamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded FilesEPSS 0.3%CVE-2025-55289HIGHChamilo: Stored Cross Site Scripting in Skills ArgumentationEPSS 0.3%CVE-2025-59542CRITICALChamilo: Account Takeover via Stored XSS in Course Learning PathsEPSS 0.3%CVE-2025-50186MEDIUMChamilo: Stored XSS via Malicious CSV Filename in user_import.phpEPSS 0.3%CVE-2025-52469HIGHChamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation BypassEPSS 0.3%CVE-2026-33710HIGHChamilo LMS has Weak REST API Key Generation (Predictable)EPSS 0.3%CVE-2026-32894HIGHChamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade ResultEPSS 0.3%CVE-2026-30881HIGHChamilo LMS: SQL Injection in the statistics AJAX endpointEPSS 0.3%CVE-2026-82535MEDIUMChamilo LMS Stored XSS via Survey Answer Submission in reporting.phpEPSS 0.3%CVE-2026-33714HIGHChamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)EPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%