Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Chamilo Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-82535`Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published09/11/2026	SeverityMedium
`CVE-2026-34239`Chamilo Authenticated Remote Code Execution	Exploitation statusNot known exploited	FixNot confirmed	Affected productchamilo-lms	Published07/20/2026	SeverityHigh
`CVE-2026-39878`Chamilo stored XSS via user registration leads to admin account takeover	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published07/20/2026	SeverityCritical
`CVE-2026-40291`Chamilo LMS has Privilege Escalation via API User Role Modification	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-35196`Chamilo LMS has OS Command Injection via export_all_certificates action	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-34602`Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-34370`Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityMedium
`CVE-2026-34161`Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityMedium
`CVE-2026-34160`Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-33715`Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-33714`Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/14/2026	SeverityHigh
`CVE-2026-33737`Chamilo LMS has an XML External Entity (XXE) Injection	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-33736`Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-33710`Chamilo LMS has Weak REST API Key Generation (Predictable)	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33708`Chamilo LMS has REST API PII Exposure via get_user_info_from_username	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-33707`Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityCritical
`CVE-2026-33706`Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33705`Chamilo LMS has unauthenticated access to Twig template source files exposes application logic	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-33704`Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33703`Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33702`Chamilo LMS has an Insecure Direct Object Reference (IDOR)	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33698`Chamilo LMS affected by unauthenticated RCE in main/install folder	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityCritical
`CVE-2026-33618`Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-33141`Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-32892`OS Command Injection in Chamilo LMS 1.11.36	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityCritical
`CVE-2026-32932`Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-32931`Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-32930`Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-32894`Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-32893`Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityMedium
`CVE-2026-31941`Server-Side Request Forgery (SSRF) in Chamilo LMS	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-31940`Session Fixation in Chamilo LMS	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2026-31939`Path Traversal (Arbitrary File Delete) in Chamilo LMS	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityHigh
`CVE-2025-66447`Chamilo LMS has validation-less redirect on login page	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published04/10/2026	SeverityInformational
`CVE-2026-30882`Chamilo LMS: Reflected XSS in the session category listing page	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/16/2026	SeverityMedium
`CVE-2026-30881`Chamilo LMS: SQL Injection in the statistics AJAX endpoint	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/16/2026	SeverityHigh
`CVE-2026-30876`Chamilo LMS: User enumeration vulnerability via response	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/16/2026	SeverityMedium
`CVE-2026-30875`Chamilo LMS: Authenticated RCE via H5P Import	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/16/2026	SeverityHigh
`CVE-2026-28430`Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/16/2026	SeverityCritical
`CVE-2026-29041`Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityHigh
`CVE-2025-59544`Chamilo: Unauthorized access to update category of any user	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityMedium
`CVE-2025-59543`Chamilo: Account Takeover via Stored XSS in Course Description	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityCritical
`CVE-2025-59542`Chamilo: Account Takeover via Stored XSS in Course Learning Paths	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityCritical
`CVE-2025-59541`Chamilo: CSRF Vulnerability in Project Deletion	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityHigh
`CVE-2025-59540`Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityMedium
`CVE-2025-55289`Chamilo: Stored Cross Site Scripting in Skills Argumentation	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/06/2026	SeverityHigh
`CVE-2025-55208`Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files	Exploitation statusNot known exploited	FixNot confirmed	Affected productchamilo-lms	Published03/05/2026	SeverityCritical
`CVE-2025-52564`Chamilo: HTML injection via open parameter	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2025-52998`Chamilo: PHAR deserialization bypass	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50199`Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-52563`Chamilo: Reflected XSS via page parameter	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2025-52475`Chamilo: Reflected XSS via keyword_inactive parameter	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2025-52476`Chamilo: Reflected XSS via keyword_active parameter	Exploitation statusNot known exploited	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2025-52470`Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2025-52469`Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-52468`Chamilo: Stored XSS Vulnerability via CSV User Import	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50198`Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50197`Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50196`Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50195`Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50194`Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50193`Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50192`Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50191`Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50190`Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50189`Chamilo: Error-based SQL Injection	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50188`Error-based SQL Injection in Chamilo LMS	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-52482`Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2025-50187`Chamilo: Evaluation of untrusted user input leads to Remote Code Execution	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityCritical
`CVE-2025-50186`Chamilo: Stored XSS via Malicious CSV Filename in user_import.php	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2024-50337`Chamilo: Potential unauthenticated blind SSRF via openid function	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityMedium
`CVE-2024-47886`Chamilo: Post-Auth Remote Code Execution	Exploitation statusPublic exploit	FixYes	Affected productchamilo-lms	Published03/02/2026	SeverityHigh
`CVE-2018-25158`Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder	Exploitation statusPublic exploit	FixNot confirmed	Affected productChamillo LMS	Published02/20/2026	SeverityHigh
`CVE-2026-1106`Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productLMS	Published01/18/2026	SeverityMedium
`CVE-2025-69581`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/16/2026	SeverityMedium
`CVE-2024-51142`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published11/15/2024	SeverityMedium
`CVE-2024-30617`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/04/2024	SeverityMedium
`CVE-2024-30618`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/04/2024	SeverityMedium
`CVE-2024-30616`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/04/2024	SeverityHigh
`CVE-2024-30619`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published11/04/2024	SeverityHigh
`CVE-2024-27524`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/01/2024	SeverityHigh
`CVE-2024-27525`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/01/2024	SeverityMedium
`CVE-2023-4225`Chamilo LMS File Upload Functionality Remote Code Execution	Exploitation statusNot known exploited	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4226`Chamilo LMS File Upload Functionality Remote Code Execution	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4224`Chamilo LMS File Upload Functionality Remote Code Execution	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4223`Chamilo LMS File Upload Functionality Remote Code Execution	Exploitation statusPublic exploit	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4222`Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4221`Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-4220`Chamilo LMS Unauthenticated Big Upload File Remote Code Execution	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityHigh
`CVE-2023-3545`Chamilo LMS Htaccess File Upload Security Bypass	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityCritical
`CVE-2023-3533`Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write	Exploitation statusNot confirmed	FixYes	Affected productChamilo	Published11/28/2023	SeverityCritical
`CVE-2023-3368`Chamilo LMS Unauthenticated Command Injection	Exploitation statusNot known exploited	FixYes	Affected productChamilo	Published11/28/2023	SeverityCritical
`CVE-2023-39582`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published09/01/2023	SeverityUnknown
`CVE-2023-39061`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published08/21/2023	SeverityUnknown
`CVE-2023-34960`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published08/01/2023	SeverityUnknown
`CVE-2023-37066`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published07/07/2023	SeverityUnknown
`CVE-2023-37067`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published07/07/2023	SeverityUnknown
`CVE-2023-37065`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published07/07/2023	SeverityUnknown
`CVE-2023-37062`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published07/07/2023	SeverityUnknown
`CVE-2023-37064`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published07/07/2023	SeverityUnknown

100 / 152 Results

Security vulnerabilities from Chamilo

Chamilo

How many security vulnerabilities does Chamilo have?

Which Chamilo product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular Chamilo products

chamilo-lms

Chamilo

Chamillo LMS

LMS