Vulnerabilidades em chamilo
88 resultadosAnálise Vexday
Com 69 CVEs catalogadas e 31 surgidas apenas nos últimos 90 dias, o Chamilo apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção contínua. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tende a indicar superfície de ataque persistente em aplicações web com geração de conteúdo dinâmico. Nenhuma CVE consta no catálogo CISA KEV, taxa abaixo da média geral do catálogo, e o maior EPSS observado é 0.0275 — incluindo o da CVE-2025-50196, apontada como a mais perigosa no momento —, o que sugere probabilidade de exploração ainda baixa no curto prazo. Ainda assim, a presença de 8 falhas críticas e 1 PoC pública disponível reforça a necessidade de manter ciclos de atualização ágeis nesta plataforma.
CVE-2026-33705MEDIUMChamilo LMS has unauthenticated access to Twig template source files exposes application logicEPSS 0.2%CVE-2026-31940HIGHSession Fixation in Chamilo LMSEPSS 0.2%CVE-2026-33702HIGHChamilo LMS has an Insecure Direct Object Reference (IDOR)EPSS 0.2%CVE-2026-31941HIGHServer-Side Request Forgery (SSRF) in Chamilo LMSEPSS 0.2%CVE-2026-34370MEDIUMChamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notesEPSS 0.2%CVE-2026-33737MEDIUMChamilo LMS has an XML External Entity (XXE) InjectionEPSS 0.2%CVE-2026-34161MEDIUMChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript ExecutionEPSS 0.2%CVE-2025-52470MEDIUMChamilo: Stored Cross-Site Scripting (XSS) via Session Category NameEPSS 0.2%CVE-2026-33708MEDIUMChamilo LMS has REST API PII Exposure via get_user_info_from_usernameEPSS 0.2%CVE-2026-33736MEDIUMChamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data ExposureEPSS 0.2%CVE-2026-33715HIGHChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer actionEPSS 0.2%CVE-2026-30876MEDIUMChamilo LMS: User enumeration vulnerability via responseEPSS 0.2%CVE-2026-34602HIGHChamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into CoursesEPSS 0.2%CVE-2026-30882MEDIUMChamilo LMS: Reflected XSS in the session category listing pageEPSS 0.2%CVE-2026-32930HIGHChamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership CheckEPSS 0.2%CVE-2025-52564MEDIUMChamilo: HTML injection via open parameterEPSS 0.2%CVE-2025-52476MEDIUMChamilo: Reflected XSS via keyword_active parameterEPSS 0.2%CVE-2025-52475MEDIUMChamilo: Reflected XSS via keyword_inactive parameterEPSS 0.2%CVE-2026-32932MEDIUMChamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course EditEPSS 0.2%CVE-2025-59540MEDIUMChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackEPSS 0.2%