Overview 103 matches · 1 in Waratek scope · 0 protected · 2 exploited · 1 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
103matches
1in Waratek scope1.0%
0protected0.0%
2exploited1.9%
1CISA KEV1.0%
2public PoC1.9%
1EPSS ≥ 0.51.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
1.0%
Outside Waratek scope
0
0.0%
Not applicable
102
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
103
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 80 / year
20181
Not applicable1
High1
not blocked1
No public exploit1
20191
Not applicable1
High1
not blocked1
No public exploit1
20201
Not applicable1
High1
not blocked1
No public exploit1
20213
Not applicable3
High3
not blocked3
Working exploit published1
No public exploit2
20226
No exploit published1
Not applicable5
High6
not blocked6
Proof of concept only1
No public exploit5
20238
Not applicable8
High8
not blocked8
Exploited1
Proof of concept only1
No public exploit6
20243
Not applicable3
High3
not blocked3
Proof of concept only2
No public exploit1
20250
202680
Not applicable80
High80
not blocked80
Exploited1
Proof of concept only18
No public exploit61
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-57554 | High | 2026-10-06 | Not applicable | No public exploit | Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. |
| CVE-2026-57545 | High | 2026-10-06 | Not applicable | No public exploit | Memory corruption when processing draw objects of incorrect type during graphics command list execution. |
| CVE-2026-25302 | High | 2026-10-06 | Not applicable | No public exploit | Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed. |
| CVE-2026-25291 | High | 2026-10-06 | Not applicable | No public exploit | Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. |
| CVE-2026-25275 | High | 2026-09-17 | Not applicable | No public exploit | Transient DOS when processing authentication frames with invalid FILS information element header lengths. |
| CVE-2026-24081 | High | 2026-09-17 | Not applicable | No public exploit | Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. |
| CVE-2026-63252 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server. |
| CVE-2026-62927 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. |
| CVE-2026-58080 | High | 2026-08-04 | Not applicable | No public exploit | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes. |
| CVE-2026-25292 | High | 2026-08-04 | Not applicable | No public exploit | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
| CVE-2026-24084 | High | 2026-08-04 | Not applicable | No public exploit | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. |
| CVE-2026-24079 | High | 2026-08-04 | Not applicable | No public exploit | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
| CVE-2026-24092 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing fastboot commands to set display mode. |
| CVE-2026-24091 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with improperly formatted input. |
| CVE-2026-24090 | High | 2026-06-01 | Not applicable | No public exploit | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. |
| CVE-2026-24089 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with invalid input. |
| CVE-2026-24088 | High | 2026-06-01 | Not applicable | No public exploit | Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader. |
| CVE-2026-24087 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot OEM commands. |
| CVE-2026-24085 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing display command line information due to improper initialization of a variable. |
| CVE-2025-59604 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
| CVE-2026-24082 | High | 2026-05-04 | Not applicable | No public exploit | Memory Corruption when copying data from a freed source while executing performance counter deselect operation. |
| CVE-2025-47404 | High | 2026-05-04 | Not applicable | No public exploit | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
| CVE-2025-47403 | High | 2026-05-04 | Not applicable | No public exploit | Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. |
| CVE-2025-47401 | High | 2026-05-04 | Not applicable | No public exploit | Transient DOS when processing target power rate tables during channel configuration. |
| CVE-2026-40291 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serialization group, enabling any user to set arbitrary roles such as ROLE_ADMIN. Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-35196 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34602 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-34160 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-33715 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3. |
| CVE-2026-33714 | High | 2026-04-14 | Not applicable | No public exploit | Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0. |
| CVE-2026-33710 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33706 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33704 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38. |
| CVE-2026-33703 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This results in mass disclosure of sensitive user information and credentials, enabling a full platform data breach. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-33702 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) parameter directly from $_REQUEST and uses it to load and modify another user's Learning Path progress — including score, status, completion, and time — without verifying that the requesting user matches the target user ID. Any authenticated user enrolled in a course can overwrite another user's Learning Path progress by simply changing the uid parameter in the request. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-33618 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3. |
| CVE-2026-32931 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32930 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-32894 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31941 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via the social_wall_new_msg_main POST parameter and performs two server-side HTTP requests to that URL without validating whether the target is an internal or external resource. This allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal services, scan internal ports, and access cloud instance metadata. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31940 | High | 2026-04-10 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. |
| CVE-2026-31939 | High | 2026-04-10 | Not applicable | Proof of concept only | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38. |
| CVE-2026-21381 | High | 2026-04-06 | Not applicable | No public exploit | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. |
| CVE-2026-21367 | High | 2026-04-06 | Not applicable | No public exploit | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. |
| CVE-2025-47392 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
| CVE-2025-47391 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption while processing a frame request from user. |
| CVE-2025-47389 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. |
| CVE-2026-30881 | High | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downstream, its output is immediately neutralized by str_replace("\'", "'", ...), which restores any injected single quotes — effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36. |
| CVE-2026-30875 | High | 2026-03-16 | Not applicable | No public exploit | Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36. |
| CVE-2026-29041 | High | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34. |
| CVE-2025-59541 | High | 2026-03-06 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34. |
| CVE-2026-21385 | High | 2026-03-02 | Not applicable | Exploited | Memory corruption while using alignments for memory allocation. |
| CVE-2025-59600 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when adding user-supplied data without checking available buffer space. |
| CVE-2025-52998 | High | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30. |
| CVE-2025-52482 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30. |
| CVE-2025-52469 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30. |
| CVE-2025-52468 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30. |
| CVE-2025-50199 | High | 2026-03-02 | Not applicable | No public exploit | Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50198 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30. |
| CVE-2025-50197 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50196 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50195 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30. |
| CVE-2025-50194 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30. |
| CVE-2025-50193 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30. |
| CVE-2025-50192 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30. |
| CVE-2025-50191 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30. |
| CVE-2025-50190 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30. |
| CVE-2025-50189 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30. |
| CVE-2025-50188 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30. |
| CVE-2025-47386 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
| CVE-2025-47385 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing trusted execution environment without proper privilege check. |
| CVE-2025-47383 | High | 2026-03-02 | Not applicable | No public exploit | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
| CVE-2025-47379 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
| CVE-2025-47377 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
| CVE-2025-47376 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
| CVE-2025-47375 | High | 2026-03-02 | Not applicable | No public exploit | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
| CVE-2025-47373 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing buffers with invalid length during TA invocation. |
| CVE-2024-47886 | High | 2026-03-02 | Not applicable | Proof of concept only | Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26. |
| CVE-2025-47398 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. |
| CVE-2025-47397 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. |
| CVE-2024-30619 | High | 2024-11-04 | Not applicable | No public exploit | Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online." |
| CVE-2024-30616 | High | 2024-11-04 | Not applicable | Proof of concept only | Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity. |
| CVE-2024-27524 | High | 2024-11-01 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component. |
| CVE-2023-4226 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4225 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4224 | High | 2023-11-28 | Not applicable | No public exploit | Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4223 | High | 2023-11-28 | Not applicable | Proof of concept only | Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. |
| CVE-2023-4222 | High | 2023-11-28 | Not applicable | No public exploit | Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters. |
| CVE-2023-4221 | High | 2023-11-28 | Not applicable | No public exploit | Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters. |
| CVE-2023-4220 | High | 2023-11-28 | Not applicable | Exploited | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. |
| CVE-2023-34962 | High | 2023-06-08 | Not applicable | No public exploit | Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes. |
| CVE-2022-42029 | High | 2022-10-17 | Not applicable | No public exploit | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory. |
| CVE-2022-40407 | High | 2022-09-29 | Not applicable | Proof of concept only | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
| CVE-2022-25897 | High | 2022-09-08 | No exploit published | No public exploit | The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False. |
| CVE-2022-27426 | High | 2022-04-15 | Not applicable | No public exploit | A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file. |
| CVE-2022-27421 | High | 2022-04-15 | Not applicable | No public exploit | Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. |
| CVE-2021-40662 | High | 2022-03-21 | Not applicable | No public exploit | A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL. |
| CVE-2021-35413 | High | 2021-12-03 | Not applicable | No public exploit | A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. |
| CVE-2020-23127 | High | 2021-05-06 | Not applicable | No public exploit | Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. |
| CVE-2021-31933 | High | 2021-04-30 | Not applicable | Working exploit published | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution. |