Overview 205 matches · 1 in Waratek scope · 0 protected · 6 exploited · 1 CISA KEV · 7 public PoC · 3 EPSS ≥ 0.5
205matches
1in Waratek scope0.5%
0protected0.0%
6exploited2.9%
1CISA KEV0.5%
7public PoC3.4%
3EPSS ≥ 0.51.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.5%
Outside Waratek scope
0
0.0%
Not applicable
204
99.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
205
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 124 / year
20131
Not applicable1
Medium1
not blocked1
Working exploit published1
20140
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20170
20184
Not applicable4
Critical1
High1
Medium2
not blocked4
No public exploit4
20195
Not applicable5
Critical1
High1
Medium3
not blocked5
No public exploit5
20205
Not applicable5
High1
Medium4
not blocked5
No public exploit5
202114
Not applicable14
Critical2
High3
Medium9
not blocked14
Exploited2
Working exploit published2
No public exploit10
202210
No exploit published1
Not applicable9
Critical1
High6
Medium3
not blocked10
Proof of concept only1
No public exploit9
202334
Not applicable34
Critical5
High8
Medium20
Low1
not blocked34
Exploited3
Proof of concept only1
No public exploit30
20247
Not applicable7
High3
Medium4
not blocked7
Proof of concept only5
No public exploit2
20250
2026124
Not applicable124
Critical11
High80
Medium32
Low1
not blocked124
Exploited1
Proof of concept only24
No public exploit99
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-57554 | High | 2026-10-06 | Not applicable | No public exploit | Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. |
| CVE-2026-57545 | High | 2026-10-06 | Not applicable | No public exploit | Memory corruption when processing draw objects of incorrect type during graphics command list execution. |
| CVE-2026-25302 | High | 2026-10-06 | Not applicable | No public exploit | Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed. |
| CVE-2026-25291 | High | 2026-10-06 | Not applicable | No public exploit | Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. |
| CVE-2026-25272 | Medium | 2026-10-06 | Not applicable | No public exploit | Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. |
| CVE-2026-25270 | Medium | 2026-10-06 | Not applicable | No public exploit | Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. |
| CVE-2026-25269 | Medium | 2026-10-06 | Not applicable | No public exploit | Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size. |
| CVE-2026-25275 | High | 2026-09-17 | Not applicable | No public exploit | Transient DOS when processing authentication frames with invalid FILS information element header lengths. |
| CVE-2026-24081 | High | 2026-09-17 | Not applicable | No public exploit | Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. |
| CVE-2026-63252 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server. |
| CVE-2026-63248 | Medium | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. |
| CVE-2026-62927 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. |
| CVE-2026-61387 | Medium | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected. |
| CVE-2026-60007 | Critical | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials. |
| CVE-2026-58080 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes. |
| CVE-2026-25292 | High | 2026-08-04 | Not applicable | No public exploit | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
| CVE-2026-25289 | Critical | 2026-08-04 | Not applicable | No public exploit | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. |
| CVE-2026-24084 | High | 2026-08-04 | Not applicable | No public exploit | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. |
| CVE-2026-24079 | High | 2026-08-04 | Not applicable | No public exploit | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
| CVE-2026-24078 | Medium | 2026-08-04 | Not applicable | No public exploit | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
| CVE-2026-24077 | Medium | 2026-08-04 | Not applicable | No public exploit | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. |
| CVE-2026-24092 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing fastboot commands to set display mode. |
| CVE-2026-24091 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with improperly formatted input. |
| CVE-2026-24090 | High | 2026-06-01 | Not applicable | No public exploit | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. |
| CVE-2026-24089 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with invalid input. |
| CVE-2026-24088 | High | 2026-06-01 | Not applicable | No public exploit | Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader. |
| CVE-2026-24087 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot OEM commands. |
| CVE-2026-24085 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing display command line information due to improper initialization of a variable. |
| CVE-2025-59610 | Medium | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer. |
| CVE-2025-59609 | Medium | 2026-06-01 | Not applicable | No public exploit | Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length. |
| CVE-2025-59604 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
| CVE-2026-24082 | High | 2026-05-04 | Not applicable | No public exploit | Memory Corruption when copying data from a freed source while executing performance counter deselect operation. |
| CVE-2025-47404 | High | 2026-05-04 | Not applicable | No public exploit | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
| CVE-2025-47403 | High | 2026-05-04 | Not applicable | No public exploit | Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. |
| CVE-2025-47401 | High | 2026-05-04 | Not applicable | No public exploit | Transient DOS when processing target power rate tables during channel configuration. |
| CVE-2026-40291 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serialization group, enabling any user to set arbitrary roles such as ROLE_ADMIN. Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-35196 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34602 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34370 | Medium | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker's browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34161 | Medium | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34160 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-33715 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-33714 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0. |
| CVE-2026-33737 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33736 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-33710 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33708 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33707 | Critical | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33706 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33705 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33704 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33703 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This results in mass disclosure of sensitive user information and credentials, enabling a full platform data breach. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-33702 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) parameter directly from $_REQUEST and uses it to load and modify another user's Learning Path progress — including score, status, completion, and time — without verifying that the requesting user matches the target user ID. Any authenticated user enrolled in a course can overwrite another user's Learning Path progress by simply changing the uid parameter in the request. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33698 | Critical | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33618 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-33141 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-32932 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id_session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32931 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32930 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32894 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32893 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $_GET parameters via array_merge() and outputs the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-32892 | Critical | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31941 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via the social_wall_new_msg_main POST parameter and performs two server-side HTTP requests to that URL without validating whether the target is an internal or external resource. This allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal services, scan internal ports, and access cloud instance metadata. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31940 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31939 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38. |
| CVE-2025-66447 | Medium | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2. |
| CVE-2026-21381 | High | 2026-04-06 | Not applicable | No public exploit | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. |
| CVE-2026-21367 | High | 2026-04-06 | Not applicable | No public exploit | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. |
| CVE-2025-47392 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
| CVE-2025-47391 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption while processing a frame request from user. |
| CVE-2025-47389 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. |
| CVE-2026-30882 | Medium | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using ">followed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered — which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36. |
| CVE-2026-30881 | High | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downstream, its output is immediately neutralized by str_replace("\'", "'", ...), which restores any injected single quotes — effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36. |
| CVE-2026-30876 | Medium | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36. |
| CVE-2026-30875 | High | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36. |
| CVE-2026-28430 | Critical | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34. |
| CVE-2026-29041 | High | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34. |
| CVE-2025-59544 | Medium | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, the functionality for the user to update the category does not implement authorization checks for the "category_id" parameter which allows users to update the category of any user by replacing the "category_id" parameter. This issue has been patched in version 1.11.34. |
| CVE-2025-59543 | Critical | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34. |
| CVE-2025-59542 | Critical | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34. |
| CVE-2025-59541 | High | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34. |
| CVE-2025-59540 | Medium | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, a stored XSS vulnerability exists in Chamilo LMS that allows a staff account to execute arbitrary JavaScript in the browser of higher-privileged admin users. The issue arises because feedback input in the exercise history page is not properly encoded before rendering, allowing malicious scripts to persist in the database and execute on view. This issue has been patched in version 1.11.34. |
| CVE-2025-55289 | Critical | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their browser within the LMS context. This enables full account takeover via session hijacking, unauthorized actions with the victim’s privileges, exfiltration of sensitive data, and potential self-propagation to other users. This issue has been patched in version 1.11.34. |
| CVE-2025-55208 | Critical | 2026-03-05 | Not applicable | No public exploit | Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue. |
| CVE-2026-21385 | High | 2026-03-02 | Not applicable | Exploited | Memory corruption while using alignments for memory allocation. |
| CVE-2025-59600 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when adding user-supplied data without checking available buffer space. |
| CVE-2025-52998 | High | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30. |
| CVE-2025-52564 | Medium | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30. |
| CVE-2025-52563 | Medium | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint. This issue has been patched in version 1.11.30. |
| CVE-2025-52482 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30. |
| CVE-2025-52476 | Medium | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization of the keyword_active parameter in admin/user_list.php. This issue has been patched in version 1.11.30. |
| CVE-2025-52475 | Medium | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php endpoint. The keyword_inactive parameter is not properly sanitized, allowing attackers to inject malicious JavaScript through a crafted URL. This issue has been patched in version 1.11.30. |
| CVE-2025-52470 | Medium | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScript payloads. The injected script is later executed when accessing add_many_sessions_to_category.php, potentially compromising administrative sessions. This issue has been patched in version 1.11.30. |
| CVE-2025-52469 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30. |
| CVE-2025-52468 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30. |
| CVE-2025-50199 | High | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50198 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30. |
| CVE-2025-50197 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50196 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50195 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30. |