Advisories · Technology
chamilo-lms.
Every CVE that names chamilo-lms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Chamilo: Reflected XSS via page parameter
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Chamilo: Reflected XSS via keyword_inactive parameter
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Chamilo: Reflected XSS via keyword_active parameter
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 7.1 High
Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass
- chamilo-lms
- CWE-841
- CVSS 8.8 High
Chamilo: Stored XSS Vulnerability via CSV User Import
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 8.8 High
Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters
- chamilo-lms
- Insecure deserialization
- CVSS 7.1 High
Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter
- chamilo-lms
- Command injection
- CVSS 7.1 High
Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter
- chamilo-lms
- Command injection
- CVSS 7.1 High
Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php
- chamilo-lms
- Command injection
- CVSS 7.1 High
Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php
- chamilo-lms
- Command injection
- CVSS 7.1 High
Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter
- chamilo-lms
- Command injection
- CVSS 8.8 High
Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php
- chamilo-lms
- SQL injection
- CVSS 7.0 High
Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script
- chamilo-lms
- SQL injection
- CVSS 8.8 High
Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script
- chamilo-lms
- SQL injection
- CVSS 7.2 High
Chamilo: Error-based SQL Injection
- chamilo-lms
- SQL injection
- CVSS 7.0 High
Error-based SQL Injection in Chamilo LMS
- chamilo-lms
- SQL injection
- CVSS 8.3 High
Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Chamilo: Evaluation of untrusted user input leads to Remote Code Execution
- chamilo-lms
- Code injection
- CVSS 4.8 Medium
Chamilo: Stored XSS via Malicious CSV Filename in user_import.php
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Chamilo: Potential unauthenticated blind SSRF via openid function
- chamilo-lms
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Chamilo: Post-Auth Remote Code Execution
- chamilo-lms
- Insecure deserialization
- CVSS 5.3 Medium
Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization
- Chamilo LMS
- Privilege escalation
- Broken access control