agentprime: chamilo-lmsEvery new CVE for chamilo-lms.https://agentprime.io/CVE-2026-45146: Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificatedhttps://agentprime.io/advisories/CVE-2026-45146/https://agentprime.io/advisories/CVE-2026-45146/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:54:46 GMTCVECVE-2026-44344: Chamilo LMS: Conditional PHP execution through vendored QuickForm evalhttps://agentprime.io/advisories/CVE-2026-44344/https://agentprime.io/advisories/CVE-2026-44344/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:32:32 GMTCVECVE-2026-45141: Chamilo LMS: CSRF in destructive skill-management AJAX actionshttps://agentprime.io/advisories/CVE-2026-45141/https://agentprime.io/advisories/CVE-2026-45141/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:30:44 GMTCVECVE-2026-45145: Chamilo LMS: Database-backed PHP object injection in career deserializationhttps://agentprime.io/advisories/CVE-2026-45145/https://agentprime.io/advisories/CVE-2026-45145/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:29:05 GMTCVECVE-2026-45144: Chamilo LMS: Stored XSS in public user-profile fieldshttps://agentprime.io/advisories/CVE-2026-45144/https://agentprime.io/advisories/CVE-2026-45144/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:27:29 GMTCVECVE-2026-114390: Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlershttps://agentprime.io/advisories/CVE-2026-114390/https://agentprime.io/advisories/CVE-2026-114390/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:39:46 GMTCVECVE-2026-114389: Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGradehttps://agentprime.io/advisories/CVE-2026-114389/https://agentprime.io/advisories/CVE-2026-114389/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:39:45 GMTCVECVE-2026-114388: Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookControllerhttps://agentprime.io/advisories/CVE-2026-114388/https://agentprime.io/advisories/CVE-2026-114388/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:39:45 GMTCVECVE-2026-112031: Chamilo LMS Ticket TicketManager.php addProject cross site scriptinghttps://agentprime.io/advisories/CVE-2026-112031/https://agentprime.io/advisories/CVE-2026-112031/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 18 Oct 2026 23:30:21 GMTCVECVE-2026-45143: Chamilo LMS: Student-to-admin stored XSS in private messages via v-htmlhttps://agentprime.io/advisories/CVE-2026-45143/https://agentprime.io/advisories/CVE-2026-45143/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 20:09:57 GMTCVEcriticalCVE-2026-82535: Chamilo LMS Stored XSS via Survey Answer Submission in reporting.phphttps://agentprime.io/advisories/CVE-2026-82535/https://agentprime.io/advisories/CVE-2026-82535/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 17:09:37 GMTCVECVE-2026-34239: Chamilo Authenticated Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-34239/https://agentprime.io/advisories/CVE-2026-34239/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 17:11:01 GMTCVECVE-2026-39878: Chamilo stored XSS via user registration leads to admin account takeoverhttps://agentprime.io/advisories/CVE-2026-39878/https://agentprime.io/advisories/CVE-2026-39878/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 17:08:21 GMTCVEcriticalCVE-2026-40291: Chamilo LMS has Privilege Escalation via API User Role Modificationhttps://agentprime.io/advisories/CVE-2026-40291/https://agentprime.io/advisories/CVE-2026-40291/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:37:55 GMTCVECVE-2026-35196: Chamilo LMS has OS Command Injection via export_all_certificates actionhttps://agentprime.io/advisories/CVE-2026-35196/https://agentprime.io/advisories/CVE-2026-35196/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:33:13 GMTCVECVE-2026-34602: Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courseshttps://agentprime.io/advisories/CVE-2026-34602/https://agentprime.io/advisories/CVE-2026-34602/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:29:06 GMTCVECVE-2026-34370: Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private noteshttps://agentprime.io/advisories/CVE-2026-34370/https://agentprime.io/advisories/CVE-2026-34370/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:25:28 GMTCVECVE-2026-34161: Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Executionhttps://agentprime.io/advisories/CVE-2026-34161/https://agentprime.io/advisories/CVE-2026-34161/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:12:48 GMTCVECVE-2026-34160: Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata serviceshttps://agentprime.io/advisories/CVE-2026-34160/https://agentprime.io/advisories/CVE-2026-34160/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:09:36 GMTCVECVE-2026-33715: Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer actionhttps://agentprime.io/advisories/CVE-2026-33715/https://agentprime.io/advisories/CVE-2026-33715/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:05:35 GMTCVECVE-2026-33714: Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)https://agentprime.io/advisories/CVE-2026-33714/https://agentprime.io/advisories/CVE-2026-33714/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:00:19 GMTCVECVE-2026-33737: Chamilo LMS has an XML External Entity (XXE) Injectionhttps://agentprime.io/advisories/CVE-2026-33737/https://agentprime.io/advisories/CVE-2026-33737/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 19:05:08 GMTCVECVE-2026-33736: Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposurehttps://agentprime.io/advisories/CVE-2026-33736/https://agentprime.io/advisories/CVE-2026-33736/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 19:03:18 GMTCVECVE-2026-33710: Chamilo LMS has Weak REST API Key Generation (Predictable)https://agentprime.io/advisories/CVE-2026-33710/https://agentprime.io/advisories/CVE-2026-33710/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:59:24 GMTCVECVE-2026-33708: Chamilo LMS has REST API PII Exposure via get_user_info_from_usernamehttps://agentprime.io/advisories/CVE-2026-33708/https://agentprime.io/advisories/CVE-2026-33708/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:54:35 GMTCVECVE-2026-33707: Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lmshttps://agentprime.io/advisories/CVE-2026-33707/https://agentprime.io/advisories/CVE-2026-33707/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:52:54 GMTCVEcriticalCVE-2026-33706: Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)https://agentprime.io/advisories/CVE-2026-33706/https://agentprime.io/advisories/CVE-2026-33706/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:51:23 GMTCVECVE-2026-33705: Chamilo LMS has unauthenticated access to Twig template source files exposes application logichttps://agentprime.io/advisories/CVE-2026-33705/https://agentprime.io/advisories/CVE-2026-33705/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:32:45 GMTCVECVE-2026-33704: Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointhttps://agentprime.io/advisories/CVE-2026-33704/https://agentprime.io/advisories/CVE-2026-33704/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:30:48 GMTCVECVE-2026-33703: Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokenshttps://agentprime.io/advisories/CVE-2026-33703/https://agentprime.io/advisories/CVE-2026-33703/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:23:01 GMTCVECVE-2026-33702: Chamilo LMS has an Insecure Direct Object Reference (IDOR)https://agentprime.io/advisories/CVE-2026-33702/https://agentprime.io/advisories/CVE-2026-33702/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:15:49 GMTCVECVE-2026-33698: Chamilo LMS affected by unauthenticated RCE in main/install folderhttps://agentprime.io/advisories/CVE-2026-33698/https://agentprime.io/advisories/CVE-2026-33698/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:14:17 GMTCVEcriticalCVE-2026-33618: Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settingshttps://agentprime.io/advisories/CVE-2026-33618/https://agentprime.io/advisories/CVE-2026-33618/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:10:16 GMTCVECVE-2026-33141: Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Datahttps://agentprime.io/advisories/CVE-2026-33141/https://agentprime.io/advisories/CVE-2026-33141/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:01:26 GMTCVECVE-2026-32892: OS Command Injection in Chamilo LMS 1.11.36https://agentprime.io/advisories/CVE-2026-32892/https://agentprime.io/advisories/CVE-2026-32892/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:56:57 GMTCVEcriticalCVE-2026-32932: Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edithttps://agentprime.io/advisories/CVE-2026-32932/https://agentprime.io/advisories/CVE-2026-32932/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:51:58 GMTCVECVE-2026-32931: Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCEhttps://agentprime.io/advisories/CVE-2026-32931/https://agentprime.io/advisories/CVE-2026-32931/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:50:40 GMTCVECVE-2026-32930: Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Checkhttps://agentprime.io/advisories/CVE-2026-32930/https://agentprime.io/advisories/CVE-2026-32930/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:48:51 GMTCVECVE-2026-32894: Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Resulthttps://agentprime.io/advisories/CVE-2026-32894/https://agentprime.io/advisories/CVE-2026-32894/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:44:24 GMTCVECVE-2026-32893: Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Paginationhttps://agentprime.io/advisories/CVE-2026-32893/https://agentprime.io/advisories/CVE-2026-32893/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:42:24 GMTCVECVE-2026-31941: Server-Side Request Forgery (SSRF) in Chamilo LMShttps://agentprime.io/advisories/CVE-2026-31941/https://agentprime.io/advisories/CVE-2026-31941/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:37:50 GMTCVECVE-2026-31940: Session Fixation in Chamilo LMShttps://agentprime.io/advisories/CVE-2026-31940/https://agentprime.io/advisories/CVE-2026-31940/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:35:10 GMTCVECVE-2026-31939: Path Traversal (Arbitrary File Delete) in Chamilo LMShttps://agentprime.io/advisories/CVE-2026-31939/https://agentprime.io/advisories/CVE-2026-31939/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:32:29 GMTCVECVE-2025-66447: Chamilo LMS has validation-less redirect on login pagehttps://agentprime.io/advisories/CVE-2025-66447/https://agentprime.io/advisories/CVE-2025-66447/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:22:32 GMTCVECVE-2026-30882: Chamilo LMS: Reflected XSS in the session category listing pagehttps://agentprime.io/advisories/CVE-2026-30882/https://agentprime.io/advisories/CVE-2026-30882/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 19:21:15 GMTCVECVE-2026-30881: Chamilo LMS: SQL Injection in the statistics AJAX endpointhttps://agentprime.io/advisories/CVE-2026-30881/https://agentprime.io/advisories/CVE-2026-30881/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 19:19:59 GMTCVECVE-2026-30876: Chamilo LMS: User enumeration vulnerability via responsehttps://agentprime.io/advisories/CVE-2026-30876/https://agentprime.io/advisories/CVE-2026-30876/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 19:18:41 GMTCVECVE-2026-30875: Chamilo LMS: Authenticated RCE via H5P Importhttps://agentprime.io/advisories/CVE-2026-30875/https://agentprime.io/advisories/CVE-2026-30875/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 19:16:37 GMTCVECVE-2026-28430: Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phphttps://agentprime.io/advisories/CVE-2026-28430/https://agentprime.io/advisories/CVE-2026-28430/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 19:13:58 GMTCVEcriticalCVE-2026-29041: Chamilo: Authenticated Remote Code Execution via Unrestricted File Uploadhttps://agentprime.io/advisories/CVE-2026-29041/https://agentprime.io/advisories/CVE-2026-29041/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 03:32:37 GMTCVE