# chamilo-lms.

Every CVE that names chamilo-lms among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Chamilo: Reflected XSS via page parameter](https://agentprime.io/advisories/CVE-2025-52563.md)
  `CVE-2025-52563` · CVE record: chamilo chamilo-lms · CVSS 5.1 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Reflected XSS via keyword_inactive parameter](https://agentprime.io/advisories/CVE-2025-52475.md)
  `CVE-2025-52475` · CVE record: chamilo chamilo-lms · CVSS 5.1 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Reflected XSS via keyword_active parameter](https://agentprime.io/advisories/CVE-2025-52476.md)
  `CVE-2025-52476` · CVE record: chamilo chamilo-lms · CVSS 5.1 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name](https://agentprime.io/advisories/CVE-2025-52470.md)
  `CVE-2025-52470` · CVE record: chamilo chamilo-lms · CVSS 4.8 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass](https://agentprime.io/advisories/CVE-2025-52469.md)
  `CVE-2025-52469` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-841
- [Chamilo: Stored XSS Vulnerability via CSV User Import](https://agentprime.io/advisories/CVE-2025-52468.md)
  `CVE-2025-52468` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters](https://agentprime.io/advisories/CVE-2025-50198.md)
  `CVE-2025-50198` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization
- [Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter](https://agentprime.io/advisories/CVE-2025-50197.md)
  `CVE-2025-50197` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: Command injection
- [Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter](https://agentprime.io/advisories/CVE-2025-50196.md)
  `CVE-2025-50196` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: Command injection
- [Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php](https://agentprime.io/advisories/CVE-2025-50195.md)
  `CVE-2025-50195` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: Command injection
- [Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php](https://agentprime.io/advisories/CVE-2025-50194.md)
  `CVE-2025-50194` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: Command injection
- [Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter](https://agentprime.io/advisories/CVE-2025-50193.md)
  `CVE-2025-50193` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: Command injection
- [Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php](https://agentprime.io/advisories/CVE-2025-50192.md)
  `CVE-2025-50192` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: SQL injection
- [Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script](https://agentprime.io/advisories/CVE-2025-50191.md)
  `CVE-2025-50191` · CVE record: chamilo chamilo-lms · CVSS 7.0 High · Not analysed yet · Published 2 Mar 2026 · Tags: SQL injection
- [Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script](https://agentprime.io/advisories/CVE-2025-50190.md)
  `CVE-2025-50190` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: SQL injection
- [Chamilo: Error-based SQL Injection](https://agentprime.io/advisories/CVE-2025-50189.md)
  `CVE-2025-50189` · CVE record: chamilo chamilo-lms · CVSS 7.2 High · Not analysed yet · Published 2 Mar 2026 · Tags: SQL injection
- [Error-based SQL Injection in Chamilo LMS](https://agentprime.io/advisories/CVE-2025-50188.md)
  `CVE-2025-50188` · CVE record: chamilo chamilo-lms · CVSS 7.0 High · Not analysed yet · Published 2 Mar 2026 · Tags: SQL injection
- [Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php](https://agentprime.io/advisories/CVE-2025-52482.md)
  `CVE-2025-52482` · CVE record: chamilo chamilo-lms · CVSS 8.3 High · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Evaluation of untrusted user input leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-50187.md)
  `CVE-2025-50187` · CVE record: chamilo chamilo-lms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection
- [Chamilo: Stored XSS via Malicious CSV Filename in user_import.php](https://agentprime.io/advisories/CVE-2025-50186.md)
  `CVE-2025-50186` · CVE record: chamilo chamilo-lms · CVSS 4.8 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo: Potential unauthenticated blind SSRF via openid function](https://agentprime.io/advisories/CVE-2024-50337.md)
  `CVE-2024-50337` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Chamilo: Post-Auth Remote Code Execution](https://agentprime.io/advisories/CVE-2024-47886.md)
  `CVE-2024-47886` · CVE record: chamilo chamilo-lms · CVSS 8.7 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization
- [Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization](https://agentprime.io/advisories/CVE-2026-1106.md)
  `CVE-2026-1106` · CVE record: Chamilo LMS · CVSS 5.3 Medium · Not analysed yet · Published 18 Jan 2026 · Tags: Privilege escalation, Broken access control

Newest: <https://agentprime.io/advisories/technology/chamilo-lms.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=chamilo-lms&cursor=WyIyMDI2LTAzLTAyVDE1OjUwOjQ1LjI5NDAwMFoiLCJDVkUtMjAyNS01MDE5OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/chamilo-lms/?cursor=WyIyMDI2LTAzLTAyVDE1OjUwOjQ1LjI5NDAwMFoiLCJDVkUtMjAyNS01MDE5OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.