Chamilo chamilo-lms

• CVE-2025-59544 Medium 6.9 Chamilo: Unauthorized access to update category of any user 0.2%
• CVE-2025-59543 Critical 9.1 Chamilo: Account Takeover via Stored XSS in Course Description 0.3%
• CVE-2025-59542 Critical 9.1 Chamilo: Account Takeover via Stored XSS in Course Learning Paths 0.3%
• CVE-2025-59541 High 8.1 Chamilo: CSRF Vulnerability in Project Deletion 0.2%
• CVE-2025-59540 Medium 6.4 Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback 0.2%
• CVE-2025-55289 High 8.8 Chamilo: Stored Cross Site Scripting in Skills Argumentation 0.3%
• CVE-2025-55208 Critical 9.1 Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files 0.4%
• CVE-2025-52564 Medium 6.9 Chamilo: HTML injection via open parameter 0.2%
• CVE-2025-52998 High 7.0 Chamilo: PHAR deserialization bypass 0.4%
• CVE-2025-50199 High 7.7 Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF) 0.4%
• CVE-2025-52563 Medium 5.1 Chamilo: Reflected XSS via page parameter 0.2%
• CVE-2025-52475 Medium 5.1 Chamilo: Reflected XSS via keyword_inactive parameter 0.2%
• CVE-2025-52476 Medium 5.1 Chamilo: Reflected XSS via keyword_active parameter 0.2%
• CVE-2025-52470 Medium 4.8 Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name 0.3%
• CVE-2025-52469 High 7.1 Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass 0.3%
• CVE-2025-52468 High 8.8 Chamilo: Stored XSS Vulnerability via CSV User Import 0.4%
• CVE-2025-50198 High 8.8 Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters 0.4%
• CVE-2025-50197 High 7.1 Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter 3.0%
• CVE-2025-50196 High 7.1 Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter 3.1%
• CVE-2025-50195 High 7.1 Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php 3.0%
• CVE-2025-50194 High 7.1 Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php 3.0%
• CVE-2025-50193 High 7.1 Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter 3.0%
• CVE-2025-50192 High 8.8 Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php 0.7%
• CVE-2025-50191 High 7.0 Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script 0.6%
• CVE-2025-50190 High 8.8 Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script 0.7%
• CVE-2025-50189 High 7.2 Chamilo: Error-based SQL Injection 0.8%
• CVE-2025-50188 High 7.0 Error-based SQL Injection in Chamilo LMS 0.8%
• CVE-2025-52482 High 8.3 Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php 0.4%
• CVE-2025-50187 Critical 9.8 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution 1.0%
• CVE-2025-50186 Medium 4.8 Chamilo: Stored XSS via Malicious CSV Filename in user_import.php 0.4%
• CVE-2024-50337 Medium 5.3 Chamilo: Potential unauthenticated blind SSRF via openid function 0.4%
• CVE-2024-47886 High 8.7 Chamilo: Post-Auth Remote Code Execution 1.1%