Chamilo vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 202310
3. 202685

Newest CVEs

• CVE-2026-45146

  Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

  chamilo · chamilo-lms

  High7.2
• CVE-2026-44344

  Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

  chamilo · chamilo-lms

  Medium6.6
• CVE-2026-45141

  Chamilo LMS: CSRF in destructive skill-management AJAX actions

  chamilo · chamilo-lms

  Medium6.5
• CVE-2026-45145

  Chamilo LMS: Database-backed PHP object injection in career deserialization

  chamilo · chamilo-lms

  High7.5
• CVE-2026-45144

  Chamilo LMS: Stored XSS in public user-profile fields

  chamilo · chamilo-lms

  High8.9
• CVE-2026-114390

  Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers

  chamilo · chamilo-lms

  Medium6.9
• CVE-2026-114389

  Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade

  chamilo · chamilo-lms

  Medium5.3
• CVE-2026-114388

  Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController

  chamilo · chamilo-lms

  Medium6.9
• CVE-2026-112031

  Chamilo LMS Ticket TicketManager.php addProject cross site scripting

  Chamilo · LMS

  Medium5.1
• CVE-2026-45140

  Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

  chamilo · chamilo-lms

  Critical9.8