Browse CVEs

HIGH 8.8 CVE-2026-40291 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in th… Chamilo Lms after 1.11.38 Fix from $1,9502026-04-14 HIGH 8.8 CVE-2026-35196 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/i… Chamilo Lms after 1.11.38 Fix from $1,9502026-04-14 HIGH 7.1 CVE-2026-34602 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecu… Chamilo Lms after 1.11.38 Fix from $1,9502026-04-14 MEDIUM 6.5 CVE-2026-34370 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Ref… Chamilo Lms after 1.11.38 Fix from $1,6002026-04-14 HIGH 8.6 CVE-2026-34160 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin e… Chamilo Lms after 1.11.38 Fix from $1,9502026-04-14 HIGH 7.2 CVE-2026-33715 Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without a… Chamilo Lms Mitigation only Fix from $1,9502026-04-14 MEDIUM 5.4 CVE-2026-34161 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists i… Chamilo Lms after 1.11.38 Fix from $1,6002026-04-14 HIGH 7.2 CVE-2026-33714 Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint… Chamilo Lms Mitigation only Fix from $1,9502026-04-14 HIGH 7.5 CVE-2026-33710 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(100… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-33708 Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email,… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 MEDIUM 6.5 CVE-2026-33736 Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users an… Chamilo Lms Patch available Fix from $1,6002026-04-10 MEDIUM 6.5 CVE-2026-33737 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 CRITICAL 9.8 CVE-2026-33698 Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ director… Chamilo Lms 1.11.38+ Fix from $2,3002026-04-10 CRITICAL 9.8 CVE-2026-33707 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email… Chamilo Lms 1.11.38+ Fix from $2,3002026-04-10 HIGH 8.8 CVE-2026-33704 Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on th… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 7.1 CVE-2026-33702 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnera… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 7.1 CVE-2026-33706 Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the u… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-33703 Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/per… Chamilo Lms Mitigation only Fix from $1,6002026-04-10 MEDIUM 5.3 CVE-2026-33705 Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible witho… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 HIGH 8.8 CVE-2026-33618 Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() t… Chamilo Lms Patch available Fix from $1,9502026-04-10 HIGH 8.8 CVE-2026-32931 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload … Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 7.1 CVE-2026-32894 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebo… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 7.1 CVE-2026-32930 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebo… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-33141 Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endp… Chamilo Lms after 1.11.38 Fix from $1,6002026-04-10 MEDIUM 6.1 CVE-2026-32932 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows a… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 HIGH 8.8 CVE-2026-31940 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are direct… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 8.8 CVE-2026-32892 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file … Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 HIGH 8.3 CVE-2026-31939 Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file fe… Chamilo Lms 1.11.38+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-31941 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 MEDIUM 5.4 CVE-2026-32893 Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list … Chamilo Lms Patch available Fix from $1,6002026-04-10