# chamilo-lms.

Every CVE that names chamilo-lms among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Chamilo LMS: Blind SQL Injection in model.ajax.php via filters\[groupOp\] authentificated](https://agentprime.io/advisories/CVE-2026-45146.md)
  `CVE-2026-45146` · CVE record: chamilo chamilo-lms · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection
- [Chamilo LMS: Conditional PHP execution through vendored QuickForm eval](https://agentprime.io/advisories/CVE-2026-44344.md)
  `CVE-2026-44344` · CVE record: chamilo chamilo-lms · CVSS 6.6 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Code injection
- [Chamilo LMS: CSRF in destructive skill-management AJAX actions](https://agentprime.io/advisories/CVE-2026-45141.md)
  `CVE-2026-45141` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Chamilo LMS: Database-backed PHP object injection in career deserialization](https://agentprime.io/advisories/CVE-2026-45145.md)
  `CVE-2026-45145` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization
- [Chamilo LMS: Stored XSS in public user-profile fields](https://agentprime.io/advisories/CVE-2026-45144.md)
  `CVE-2026-45144` · CVE record: chamilo chamilo-lms · CVSS 8.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers](https://agentprime.io/advisories/CVE-2026-114390.md)
  `CVE-2026-114390` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade](https://agentprime.io/advisories/CVE-2026-114389.md)
  `CVE-2026-114389` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController](https://agentprime.io/advisories/CVE-2026-114388.md)
  `CVE-2026-114388` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Chamilo LMS Ticket TicketManager.php addProject cross site scripting](https://agentprime.io/advisories/CVE-2026-112031.md)
  `CVE-2026-112031` · CVE record: Chamilo LMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Chamilo LMS: Student-to-admin stored XSS in private messages via v-html](https://agentprime.io/advisories/CVE-2026-45143.md)
  `CVE-2026-45143` · CVE record: chamilo chamilo-lms · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php](https://agentprime.io/advisories/CVE-2026-82535.md)
  `CVE-2026-82535` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo Authenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-34239.md)
  `CVE-2026-34239` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control
- [Chamilo stored XSS via user registration leads to admin account takeover](https://agentprime.io/advisories/CVE-2026-39878.md)
  `CVE-2026-39878` · CVE record: chamilo chamilo-lms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS has Privilege Escalation via API User Role Modification](https://agentprime.io/advisories/CVE-2026-40291.md)
  `CVE-2026-40291` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: Privilege escalation, Broken access control
- [Chamilo LMS has OS Command Injection via export_all_certificates action](https://agentprime.io/advisories/CVE-2026-35196.md)
  `CVE-2026-35196` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: Command injection
- [Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses](https://agentprime.io/advisories/CVE-2026-34602.md)
  `CVE-2026-34602` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: Broken access control
- [Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes](https://agentprime.io/advisories/CVE-2026-34370.md)
  `CVE-2026-34370` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Broken access control
- [Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution](https://agentprime.io/advisories/CVE-2026-34161.md)
  `CVE-2026-34161` · CVE record: chamilo chamilo-lms · CVSS 5.1 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services](https://agentprime.io/advisories/CVE-2026-34160.md)
  `CVE-2026-34160` · CVE record: chamilo chamilo-lms · CVSS 8.6 High · Not analysed yet · Published 14 Apr 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action](https://agentprime.io/advisories/CVE-2026-33715.md)
  `CVE-2026-33715` · CVE record: chamilo chamilo-lms · CVSS 7.2 High · Not analysed yet · Published 14 Apr 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)](https://agentprime.io/advisories/CVE-2026-33714.md)
  `CVE-2026-33714` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: SQL injection
- [Chamilo LMS has an XML External Entity (XXE) Injection](https://agentprime.io/advisories/CVE-2026-33737.md)
  `CVE-2026-33737` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: XML external entities (XXE)
- [Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure](https://agentprime.io/advisories/CVE-2026-33736.md)
  `CVE-2026-33736` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Chamilo LMS has Weak REST API Key Generation (Predictable)](https://agentprime.io/advisories/CVE-2026-33710.md)
  `CVE-2026-33710` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Chamilo LMS has REST API PII Exposure via get_user_info_from_username](https://agentprime.io/advisories/CVE-2026-33708.md)
  `CVE-2026-33708` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms](https://agentprime.io/advisories/CVE-2026-33707.md)
  `CVE-2026-33707` · CVE record: chamilo chamilo-lms · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-640
- [Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)](https://agentprime.io/advisories/CVE-2026-33706.md)
  `CVE-2026-33706` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Privilege escalation
- [Chamilo LMS has unauthenticated access to Twig template source files exposes application logic](https://agentprime.io/advisories/CVE-2026-33705.md)
  `CVE-2026-33705` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Information disclosure
- [Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint](https://agentprime.io/advisories/CVE-2026-33704.md)
  `CVE-2026-33704` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Unrestricted file upload
- [Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens](https://agentprime.io/advisories/CVE-2026-33703.md)
  `CVE-2026-33703` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Chamilo LMS has an Insecure Direct Object Reference (IDOR)](https://agentprime.io/advisories/CVE-2026-33702.md)
  `CVE-2026-33702` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Chamilo LMS affected by unauthenticated RCE in main/install folder](https://agentprime.io/advisories/CVE-2026-33698.md)
  `CVE-2026-33698` · CVE record: chamilo chamilo-lms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: Information disclosure
- [Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings](https://agentprime.io/advisories/CVE-2026-33618.md)
  `CVE-2026-33618` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 10 Apr 2026 · Tags: Code injection
- [Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data](https://agentprime.io/advisories/CVE-2026-33141.md)
  `CVE-2026-33141` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [OS Command Injection in Chamilo LMS 1.11.36](https://agentprime.io/advisories/CVE-2026-32892.md)
  `CVE-2026-32892` · CVE record: chamilo chamilo-lms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: Command injection
- [Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit](https://agentprime.io/advisories/CVE-2026-32932.md)
  `CVE-2026-32932` · CVE record: chamilo chamilo-lms · CVSS 4.7 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Open redirect
- [Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE](https://agentprime.io/advisories/CVE-2026-32931.md)
  `CVE-2026-32931` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Unrestricted file upload
- [Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check](https://agentprime.io/advisories/CVE-2026-32930.md)
  `CVE-2026-32930` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result](https://agentprime.io/advisories/CVE-2026-32894.md)
  `CVE-2026-32894` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Memory corruption, Broken access control
- [Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination](https://agentprime.io/advisories/CVE-2026-32893.md)
  `CVE-2026-32893` · CVE record: chamilo chamilo-lms · CVSS 5.4 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Server-Side Request Forgery (SSRF) in Chamilo LMS](https://agentprime.io/advisories/CVE-2026-31941.md)
  `CVE-2026-31941` · CVE record: chamilo chamilo-lms · CVSS 7.7 High · Not analysed yet · Published 10 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Session Fixation in Chamilo LMS](https://agentprime.io/advisories/CVE-2026-31940.md)
  `CVE-2026-31940` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Authentication bypass
- [Path Traversal (Arbitrary File Delete) in Chamilo LMS](https://agentprime.io/advisories/CVE-2026-31939.md)
  `CVE-2026-31939` · CVE record: chamilo chamilo-lms · CVSS 8.3 High · Not analysed yet · Published 10 Apr 2026 · Tags: Path traversal
- [Chamilo LMS has validation-less redirect on login page](https://agentprime.io/advisories/CVE-2025-66447.md)
  `CVE-2025-66447` · CVE record: chamilo chamilo-lms · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2026 · Tags: Open redirect
- [Chamilo LMS: Reflected XSS in the session category listing page](https://agentprime.io/advisories/CVE-2026-30882.md)
  `CVE-2026-30882` · CVE record: chamilo chamilo-lms · CVSS 6.1 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS: SQL Injection in the statistics AJAX endpoint](https://agentprime.io/advisories/CVE-2026-30881.md)
  `CVE-2026-30881` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 16 Mar 2026 · Tags: SQL injection
- [Chamilo LMS: User enumeration vulnerability via response](https://agentprime.io/advisories/CVE-2026-30876.md)
  `CVE-2026-30876` · CVE record: chamilo chamilo-lms · CVSS 6.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-204
- [Chamilo LMS: Authenticated RCE via H5P Import](https://agentprime.io/advisories/CVE-2026-30875.md)
  `CVE-2026-30875` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 16 Mar 2026 · Tags: Code injection
- [Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php](https://agentprime.io/advisories/CVE-2026-28430.md)
  `CVE-2026-28430` · CVE record: chamilo chamilo-lms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Mar 2026 · Tags: SQL injection
- [Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload](https://agentprime.io/advisories/CVE-2026-29041.md)
  `CVE-2026-29041` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 6 Mar 2026 · Tags: Unrestricted file upload
- [Chamilo: Unauthorized access to update category of any user](https://agentprime.io/advisories/CVE-2025-59544.md)
  `CVE-2025-59544` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Broken access control
- [Chamilo: Account Takeover via Stored XSS in Course Description](https://agentprime.io/advisories/CVE-2025-59543.md)
  `CVE-2025-59543` · CVE record: chamilo chamilo-lms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Account Takeover via Stored XSS in Course Learning Paths](https://agentprime.io/advisories/CVE-2025-59542.md)
  `CVE-2025-59542` · CVE record: chamilo chamilo-lms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: CSRF Vulnerability in Project Deletion](https://agentprime.io/advisories/CVE-2025-59541.md)
  `CVE-2025-59541` · CVE record: chamilo chamilo-lms · CVSS 8.1 High · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site request forgery (CSRF)
- [Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback](https://agentprime.io/advisories/CVE-2025-59540.md)
  `CVE-2025-59540` · CVE record: chamilo chamilo-lms · CVSS 6.4 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Stored Cross Site Scripting in Skills Argumentation](https://agentprime.io/advisories/CVE-2025-55289.md)
  `CVE-2025-55289` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files](https://agentprime.io/advisories/CVE-2025-55208.md)
  `CVE-2025-55208` · CVE record: chamilo chamilo-lms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: HTML injection via open parameter](https://agentprime.io/advisories/CVE-2025-52564.md)
  `CVE-2025-52564` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: PHAR deserialization bypass](https://agentprime.io/advisories/CVE-2025-52998.md)
  `CVE-2025-52998` · CVE record: chamilo chamilo-lms · CVSS 7.0 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization
- [Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)](https://agentprime.io/advisories/CVE-2025-50199.md)
  `CVE-2025-50199` · CVE record: chamilo chamilo-lms · CVSS 7.7 High · Not analysed yet · Published 2 Mar 2026 · Tags: Server-side request forgery (SSRF)

Older: <https://agentprime.io/advisories/technology/chamilo-lms.md?cursor=WyIyMDI2LTAzLTAyVDE1OjUwOjQ1LjI5NDAwMFoiLCJDVkUtMjAyNS01MDE5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=chamilo-lms>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/chamilo-lms/>. Everything for agents: <https://agentprime.io/llms.txt>.