Overview 205 matches · 1 in Waratek scope · 0 protected · 6 exploited · 1 CISA KEV · 7 public PoC · 3 EPSS ≥ 0.5
205matches
1in Waratek scope0.5%
0protected0.0%
6exploited2.9%
1CISA KEV0.5%
7public PoC3.4%
3EPSS ≥ 0.51.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.5%
Outside Waratek scope
0
0.0%
Not applicable
204
99.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
205
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 124 / year
20131
Not applicable1
Medium1
not blocked1
Working exploit published1
20140
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20170
20184
Not applicable4
Critical1
High1
Medium2
not blocked4
No public exploit4
20195
Not applicable5
Critical1
High1
Medium3
not blocked5
No public exploit5
20205
Not applicable5
High1
Medium4
not blocked5
No public exploit5
202114
Not applicable14
Critical2
High3
Medium9
not blocked14
Exploited2
Working exploit published2
No public exploit10
202210
No exploit published1
Not applicable9
Critical1
High6
Medium3
not blocked10
Proof of concept only1
No public exploit9
202334
Not applicable34
Critical5
High8
Medium20
Low1
not blocked34
Exploited3
Proof of concept only1
No public exploit30
20247
Not applicable7
High3
Medium4
not blocked7
Proof of concept only5
No public exploit2
20250
2026124
Not applicable124
Critical11
High80
Medium32
Low1
not blocked124
Exploited1
Proof of concept only24
No public exploit99
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-50194 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30. |
| CVE-2025-50193 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50192 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30. |
| CVE-2025-50191 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30. |
| CVE-2025-50190 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30. |
| CVE-2025-50189 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30. |
| CVE-2025-50188 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30. |
| CVE-2025-50187 | Critical | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28. |
| CVE-2025-50186 | Medium | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30. |
| CVE-2025-47386 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
| CVE-2025-47385 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing trusted execution environment without proper privilege check. |
| CVE-2025-47383 | High | 2026-03-02 | Not applicable | No public exploit | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
| CVE-2025-47379 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
| CVE-2025-47377 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
| CVE-2025-47376 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
| CVE-2025-47375 | High | 2026-03-02 | Not applicable | No public exploit | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
| CVE-2025-47373 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing buffers with invalid length during TA invocation. |
| CVE-2025-47371 | Medium | 2026-03-02 | Not applicable | No public exploit | Transient DOS when an LTE RLC packet with invalid TB is received by UE. |
| CVE-2024-50337 | Medium | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28. |
| CVE-2024-47886 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26. |
| CVE-2025-47398 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. |
| CVE-2025-47397 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. |
| CVE-2026-1106 | Low | 2026-01-18 | Not applicable | Proof of concept only | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/SocialController.php of the component Legal Consent Handler. Performing a manipulation of the argument userId results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-69581 | Medium | 2026-01-16 | Not applicable | Proof of concept only | An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks. |
| CVE-2024-51142 | Medium | 2024-11-15 | Not applicable | No public exploit | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file. |
| CVE-2024-30619 | High | 2024-11-04 | Not applicable | No public exploit | Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online." |
| CVE-2024-30618 | Medium | 2024-11-04 | Not applicable | Proof of concept only | A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_topics.php'. |
| CVE-2024-30617 | Medium | 2024-11-04 | Not applicable | Proof of concept only | A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge. |
| CVE-2024-30616 | High | 2024-11-04 | Not applicable | Proof of concept only | Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity. |
| CVE-2024-27525 | Medium | 2024-11-01 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component. |
| CVE-2024-27524 | High | 2024-11-01 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component. |
| CVE-2023-4226 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4225 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4224 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4223 | High | 2023-11-28 | Not applicable | Proof of concept only | Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4222 | High | 2023-11-28 | Not applicable | No public exploit | Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters. |
| CVE-2023-4221 | High | 2023-11-28 | Not applicable | No public exploit | Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters. |
| CVE-2023-4220 | High | 2023-11-28 | Not applicable | Exploited | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. |
| CVE-2023-3545 | Critical | 2023-11-28 | Not applicable | No public exploit | Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution. |
| CVE-2023-3533 | Critical | 2023-11-28 | Not applicable | No public exploit | Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write. |
| CVE-2023-3368 | Critical | 2023-11-28 | Not applicable | Exploited | Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960. |
| CVE-2023-39582 | Medium | 2023-09-01 | Not applicable | No public exploit | SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions. |
| CVE-2023-39061 | Low | 2023-08-21 | Not applicable | No public exploit | Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. |
| CVE-2023-34960 | Critical | 2023-08-01 | Not applicable | Exploited | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. |
| CVE-2023-37067 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section. |
| CVE-2023-37066 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel. |
| CVE-2023-37065 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section. |
| CVE-2023-37064 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section. |
| CVE-2023-37063 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. |
| CVE-2023-37062 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition. |
| CVE-2023-37061 | Medium | 2023-07-07 | Not applicable | No public exploit | Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. |
| CVE-2023-34944 | Critical | 2023-06-13 | Not applicable | No public exploit | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file. |
| CVE-2023-34962 | High | 2023-06-08 | Not applicable | No public exploit | Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes. |
| CVE-2023-34961 | Medium | 2023-06-08 | Not applicable | No public exploit | Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field. |
| CVE-2023-34959 | Medium | 2023-06-08 | Not applicable | No public exploit | An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools. |
| CVE-2023-34958 | Medium | 2023-06-08 | Not applicable | No public exploit | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID. |
| CVE-2023-31807 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function. |
| CVE-2023-31806 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function. |
| CVE-2023-31805 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function. |
| CVE-2023-31804 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters. |
| CVE-2023-31803 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters. |
| CVE-2023-31802 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters. |
| CVE-2023-31801 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. |
| CVE-2023-31800 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter. |
| CVE-2023-31799 | Medium | 2023-05-09 | Not applicable | No public exploit | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter. |
| CVE-2022-42029 | High | 2022-10-17 | Not applicable | No public exploit | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory. |
| CVE-2022-40407 | High | 2022-09-29 | Not applicable | Proof of concept only | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
| CVE-2022-25897 | High | 2022-09-08 | No exploit published | No public exploit | The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False. |
| CVE-2022-27426 | High | 2022-04-15 | Not applicable | No public exploit | A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file. |
| CVE-2022-27425 | Medium | 2022-04-15 | Not applicable | No public exploit | Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. |
| CVE-2022-27423 | Critical | 2022-04-15 | Not applicable | No public exploit | Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php. |
| CVE-2022-27422 | Medium | 2022-04-15 | Not applicable | No public exploit | A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL. |
| CVE-2022-27421 | High | 2022-04-15 | Not applicable | No public exploit | Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. |
| CVE-2021-40662 | High | 2022-03-21 | Not applicable | No public exploit | A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL. |
| CVE-2021-38745 | Medium | 2022-03-21 | Not applicable | No public exploit | Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page. |
| CVE-2021-35415 | Medium | 2021-12-03 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields. |
| CVE-2021-35414 | Critical | 2021-12-03 | Not applicable | No public exploit | Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. |
| CVE-2021-35413 | High | 2021-12-03 | Not applicable | No public exploit | A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. |
| CVE-2021-43687 | Medium | 2021-12-01 | Not applicable | No public exploit | chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie. |
| CVE-2020-23126 | Medium | 2021-11-03 | Not applicable | No public exploit | Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends. |
| CVE-2021-37391 | Medium | 2021-08-10 | Not applicable | Working exploit published | A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature. |
| CVE-2021-37390 | Medium | 2021-08-10 | Not applicable | No public exploit | A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). |
| CVE-2021-37389 | Medium | 2021-08-10 | Not applicable | No public exploit | Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. |
| CVE-2021-34187 | Critical | 2021-06-28 | Not applicable | Exploited | main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. |
| CVE-2021-32925 | Medium | 2021-05-13 | Not applicable | No public exploit | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. |
| CVE-2020-23128 | Medium | 2021-05-06 | Not applicable | No public exploit | Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege. |
| CVE-2020-23127 | High | 2021-05-06 | Not applicable | No public exploit | Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. |
| CVE-2021-31933 | High | 2021-04-30 | Not applicable | Working exploit published | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution. |
| CVE-2021-26746 | Medium | 2021-02-19 | Not applicable | Exploited | Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. |
| CVE-2012-4029 | Medium | 2020-02-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action. |
| CVE-2013-0739 | Medium | 2020-01-30 | Not applicable | No public exploit | Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. |
| CVE-2013-0738 | Medium | 2020-01-30 | Not applicable | No public exploit | Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. |
| CVE-2012-4030 | High | 2020-01-10 | Not applicable | No public exploit | Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. |
| CVE-2015-9540 | Medium | 2020-01-04 | Not applicable | No public exploit | Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503. |
| CVE-2019-13082 | Critical | 2019-06-30 | Not applicable | No public exploit | Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir. |
| CVE-2019-7383 | High | 2019-03-21 | Not applicable | No public exploit | An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/isp_update_edit.php does not properly validate user input, which leads to shell command injection via the des parameter. |
| CVE-2018-19525 | Medium | 2019-03-21 | Not applicable | No public exploit | An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation. |
| CVE-2019-1000017 | Medium | 2019-02-04 | Not applicable | No public exploit | Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03. |
| CVE-2019-1000015 | Medium | 2019-02-04 | Not applicable | No public exploit | Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03. |
| CVE-2018-20329 | High | 2018-12-21 | Not applicable | No public exploit | Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information. |