Betroffene Versionslinien
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-45146 | Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated | * | 7.2 | — | 2026-11-04 | |
| CVE-2026-44344 | Chamilo LMS: Conditional PHP execution through vendored QuickForm eval | * | 6.6 | — | 2026-10-30 | |
| CVE-2026-45141 | Chamilo LMS: CSRF in destructive skill-management AJAX actions | * | 6.5 | — | 2026-10-30 | |
| CVE-2026-45145 | Chamilo LMS: Database-backed PHP object injection in career deserialization | * | 7.5 | — | 2026-10-30 | |
| CVE-2026-45144 | Chamilo LMS: Stored XSS in public user-profile fields | * | 8.9 | — | 2026-10-30 | |
| CVE-2026-114390 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers | ≥ 2.0.0-alpha.1 < 2.0.0-RC.3 | 6.9 | — | 2026-10-21 | |
| CVE-2026-114388 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController | ≥ 2.0.0-alpha.1 < 2.0.0-RC.3 | 6.9 | — | 2026-10-21 | |
| CVE-2026-114389 | Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade | ≥ 2.0.0-alpha.4 < 2.0.0-RC.3 | 5.3 | — | 2026-10-21 | |
| CVE-2026-112031 | Chamilo LMS Ticket TicketManager.php addProject cross site scripting | * | 5.1 | — | 2026-10-19 | |
| CVE-2026-45140 | Chamilo LMS CStudio upload flow allows unauthenticated remote code execution | * | 9.8 | — | 2026-09-18 | |
| CVE-2026-45143 | Chamilo LMS: Student-to-admin stored XSS in private messages via v-html | * | 9.0 | — | 2026-09-18 | |
| CVE-2026-82535 | Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php | ≥ 1.11.0 ≤ 1.11.40 ≥ 2.0.0 ≤ 2.0.3 | 5.3 | — | 2026-09-12 | |
| CVE-2026-34239 | Chamilo Authenticated Remote Code Execution | * | 7.5 | — | 2026-07-21 | |
| CVE-2026-39878 | Chamilo stored XSS via user registration leads to admin account takeover | * | 9.3 | — | 2026-07-21 | |
| CVE-2026-40291 | Chamilo LMS has Privilege Escalation via API User Role Modification | * | 8.8 | — | 2026-04-15 | |
| CVE-2026-35196 | Chamilo LMS has OS Command Injection via export_all_certificates action | * | 8.8 | — | 2026-04-15 | |
| CVE-2026-34602 | Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses | * | 7.1 | — | 2026-04-15 | |
| CVE-2026-34370 | Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes | * | 6.5 | — | 2026-04-15 | |
| CVE-2026-34161 | Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Exe... | * | 5.1 | — | 2026-04-15 | |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud me... | * | 8.6 | — | 2026-04-15 | |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action | * | 7.2 | — | 2026-04-15 | |
| CVE-2026-33714 | Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) | * | 7.1 | — | 2026-04-15 | |
| CVE-2026-33737 | Chamilo LMS has an XML External Entity (XXE) Injection | * | 5.3 | — | 2026-04-11 | |
| CVE-2026-33736 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure | * | 6.5 | — | 2026-04-11 | |
| CVE-2026-33710 | Chamilo LMS has Weak REST API Key Generation (Predictable) | * | 7.5 | — | 2026-04-11 | |
| CVE-2026-33708 | Chamilo LMS has REST API PII Exposure via get_user_info_from_username | * | 6.5 | — | 2026-04-11 | |
| CVE-2026-33707 | Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms | * | 9.4 | — | 2026-04-11 | |
| CVE-2026-33706 | Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-33705 | Chamilo LMS has unauthenticated access to Twig template source files exposes application logic | * | 5.3 | — | 2026-04-11 | |
| CVE-2026-33704 | Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-33703 | Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-33702 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-33698 | Chamilo LMS affected by unauthenticated RCE in main/install folder | * | 9.3 | — | 2026-04-11 | |
| CVE-2026-33618 | Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings | * | 8.8 | — | 2026-04-11 | |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data | * | 6.5 | — | 2026-04-11 | |
| CVE-2026-32892 | OS Command Injection in Chamilo LMS 1.11.36 | * | 9.1 | — | 2026-04-11 | |
| CVE-2026-32932 | Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit | * | 4.7 | — | 2026-04-11 | |
| CVE-2026-32931 | Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE | * | 7.5 | — | 2026-04-11 | |
| CVE-2026-32930 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-32894 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-32893 | Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination | * | 5.4 | — | 2026-04-11 | |
| CVE-2026-31941 | Server-Side Request Forgery (SSRF) in Chamilo LMS | * | 7.7 | — | 2026-04-11 | |
| CVE-2026-31940 | Session Fixation in Chamilo LMS | * | 7.5 | — | 2026-04-11 | |
| CVE-2026-31939 | Path Traversal (Arbitrary File Delete) in Chamilo LMS | * | 8.3 | — | 2026-04-11 | |
| CVE-2025-66447 | Chamilo LMS has validation-less redirect on login page | * | 0.0 | — | 2026-04-11 | |
| CVE-2026-30882 | Chamilo LMS: Reflected XSS in the session category listing page | * | 6.1 | — | 2026-03-17 | |
| CVE-2026-30881 | Chamilo LMS: SQL Injection in the statistics AJAX endpoint | * | 8.8 | — | 2026-03-17 | |
| CVE-2026-30876 | Chamilo LMS: User enumeration vulnerability via response | * | 6.3 | — | 2026-03-17 | |
| CVE-2026-30875 | Chamilo LMS: Authenticated RCE via H5P Import | * | 8.8 | — | 2026-03-17 | |
| CVE-2026-28430 | Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php | * | 9.3 | — | 2026-03-17 | |
| CVE-2026-29041 | Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload | * | 8.8 | — | 2026-03-06 | |
| CVE-2025-59544 | Chamilo: Unauthorized access to update category of any user | * | 6.9 | — | 2026-03-06 | |
| CVE-2025-59543 | Chamilo: Account Takeover via Stored XSS in Course Description | * | 9.1 | — | 2026-03-06 | |
| CVE-2025-59542 | Chamilo: Account Takeover via Stored XSS in Course Learning Paths | * | 9.1 | — | 2026-03-06 | |
| CVE-2025-59541 | Chamilo: CSRF Vulnerability in Project Deletion | * | 8.1 | — | 2026-03-06 | |
| CVE-2025-59540 | Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback | * | 6.4 | — | 2026-03-06 | |
| CVE-2025-55289 | Chamilo: Stored Cross Site Scripting in Skills Argumentation | * | 8.8 | — | 2026-03-06 | |
| CVE-2025-55208 | Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files | * | 9.1 | — | 2026-03-06 | |
| CVE-2025-52564 | Chamilo: HTML injection via open parameter | * | 6.9 | — | 2026-03-03 | |
| CVE-2025-52998 | Chamilo: PHAR deserialization bypass | * | 7.0 | — | 2026-03-03 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).