CVE-2026-82535Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php Exploitation status Not known exploited Fix Published 09/11/2026 Severity Medium CVE-2026-34239Chamilo Authenticated Remote Code Execution Exploitation status Not known exploited Fix Not confirmed Published 07/20/2026 Severity High CVE-2026-39878Chamilo stored XSS via user registration leads to admin account takeover Exploitation status Not known exploited Fix Published 07/20/2026 Severity Critical CVE-2026-40291Chamilo LMS has Privilege Escalation via API User Role Modification Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-35196Chamilo LMS has OS Command Injection via export_all_certificates action Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-34602Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-34370Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes Exploitation status Not known exploited Fix Published 04/14/2026 Severity Medium CVE-2026-34161Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution Exploitation status Not known exploited Fix Published 04/14/2026 Severity Medium CVE-2026-34160Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-33715Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-33714Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) Exploitation status Not known exploited Fix Published 04/14/2026 Severity High CVE-2026-33737Chamilo LMS has an XML External Entity (XXE) Injection Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-33736Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-33710Chamilo LMS has Weak REST API Key Generation (Predictable) Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-33708Chamilo LMS has REST API PII Exposure via get_user_info_from_username Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-33707Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms Exploitation status Not known exploited Fix Published 04/10/2026 Severity Critical CVE-2026-33706Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-33705Chamilo LMS has unauthenticated access to Twig template source files exposes application logic Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-33704Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-33703Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-33702Chamilo LMS has an Insecure Direct Object Reference (IDOR) Exploitation status Public exploit Fix Published 04/10/2026 Severity High CVE-2026-33698Chamilo LMS affected by unauthenticated RCE in main/install folder Exploitation status Not known exploited Fix Published 04/10/2026 Severity Critical CVE-2026-33618Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-33141Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-32892OS Command Injection in Chamilo LMS 1.11.36 Exploitation status Not known exploited Fix Published 04/10/2026 Severity Critical CVE-2026-32932Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-32931Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-32930Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-32894Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result Exploitation status Public exploit Fix Published 04/10/2026 Severity High CVE-2026-32893Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination Exploitation status Not known exploited Fix Published 04/10/2026 Severity Medium CVE-2026-31941Server-Side Request Forgery (SSRF) in Chamilo LMS Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-31940Session Fixation in Chamilo LMS Exploitation status Not known exploited Fix Published 04/10/2026 Severity High CVE-2026-31939Path Traversal (Arbitrary File Delete) in Chamilo LMS Exploitation status Public exploit Fix Published 04/10/2026 Severity High CVE-2025-66447Chamilo LMS has validation-less redirect on login page Exploitation status Not known exploited Fix Published 04/10/2026 Severity Informational CVE-2026-30882Chamilo LMS: Reflected XSS in the session category listing page Exploitation status Not known exploited Fix Published 03/16/2026 Severity Medium CVE-2026-30881Chamilo LMS: SQL Injection in the statistics AJAX endpoint Exploitation status Not known exploited Fix Published 03/16/2026 Severity High CVE-2026-30876Chamilo LMS: User enumeration vulnerability via response Exploitation status Not known exploited Fix Published 03/16/2026 Severity Medium CVE-2026-30875Chamilo LMS: Authenticated RCE via H5P Import Exploitation status Not known exploited Fix Published 03/16/2026 Severity High CVE-2026-28430Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php Exploitation status Not known exploited Fix Published 03/16/2026 Severity Critical CVE-2026-29041Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload Exploitation status Not known exploited Fix Published 03/06/2026 Severity High CVE-2025-59544Chamilo: Unauthorized access to update category of any user Exploitation status Not known exploited Fix Published 03/06/2026 Severity Medium CVE-2025-59543Chamilo: Account Takeover via Stored XSS in Course Description Exploitation status Not known exploited Fix Published 03/06/2026 Severity Critical CVE-2025-59542Chamilo: Account Takeover via Stored XSS in Course Learning Paths Exploitation status Not known exploited Fix Published 03/06/2026 Severity Critical CVE-2025-59541Chamilo: CSRF Vulnerability in Project Deletion Exploitation status Not known exploited Fix Published 03/06/2026 Severity High CVE-2025-59540Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback Exploitation status Not known exploited Fix Published 03/06/2026 Severity Medium CVE-2025-55289Chamilo: Stored Cross Site Scripting in Skills Argumentation Exploitation status Not known exploited Fix Published 03/06/2026 Severity High CVE-2025-55208Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files Exploitation status Not known exploited Fix Not confirmed Published 03/05/2026 Severity Critical CVE-2025-52564Chamilo: HTML injection via open parameter Exploitation status Not known exploited Fix Published 03/02/2026 Severity Medium CVE-2025-52998Chamilo: PHAR deserialization bypass Exploitation status Not known exploited Fix Published 03/02/2026 Severity High CVE-2025-50199Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF) Exploitation status Not known exploited Fix Published 03/02/2026 Severity High CVE-2025-52563Chamilo: Reflected XSS via page parameter Exploitation status Not known exploited Fix Published 03/02/2026 Severity Medium CVE-2025-52475Chamilo: Reflected XSS via keyword_inactive parameter Exploitation status Not known exploited Fix Published 03/02/2026 Severity Medium CVE-2025-52476Chamilo: Reflected XSS via keyword_active parameter Exploitation status Not known exploited Fix Published 03/02/2026 Severity Medium CVE-2025-52470Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name Exploitation status Public exploit Fix Published 03/02/2026 Severity Medium CVE-2025-52469Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-52468Chamilo: Stored XSS Vulnerability via CSV User Import Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50198Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50197Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50196Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50195Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50194Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50193Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50192Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50191Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50190Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50189Chamilo: Error-based SQL Injection Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50188Error-based SQL Injection in Chamilo LMS Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-52482Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php Exploitation status Public exploit Fix Published 03/02/2026 Severity High CVE-2025-50187Chamilo: Evaluation of untrusted user input leads to Remote Code Execution Exploitation status Public exploit Fix Published 03/02/2026 Severity Critical CVE-2025-50186Chamilo: Stored XSS via Malicious CSV Filename in user_import.php Exploitation status Public exploit Fix Published 03/02/2026 Severity Medium CVE-2024-50337Chamilo: Potential unauthenticated blind SSRF via openid function Exploitation status Public exploit Fix Published 03/02/2026 Severity Medium CVE-2024-47886Chamilo: Post-Auth Remote Code Execution Exploitation status Public exploit Fix Published 03/02/2026 Severity High 
