Chamilo

chamilo

148 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (148)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-34961 1Chamilo 1Chamilo Lms Jun 17, 2026 Jun 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
CVE-2023-34959 1Chamilo 1Chamilo Lms Jun 17, 2026 Jun 8, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.
CVE-2023-34958 1Chamilo 1Chamilo Lms Jun 17, 2026 Jun 8, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.
CVE-2023-31807 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
CVE-2023-31806 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
CVE-2023-31805 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
CVE-2023-31804 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
CVE-2023-31803 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
CVE-2023-31802 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
CVE-2023-31801 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
CVE-2023-31800 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVE-2023-31799 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
CVE-2022-42029 1Chamilo 1Chamilo Jun 17, 2026 Oct 17, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web direc...Show more Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory.Show less
CVE-2022-40407 1Chamilo 1Chamilo Jun 17, 2026 Sep 29, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
CVE-2022-27426 1Chamilo 1Chamilo Lms Jun 17, 2026 Apr 15, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.
CVE-2022-27425 1Chamilo 1Chamilo Jun 17, 2026 Apr 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
CVE-2022-27423 1Chamilo 1Chamilo Lms Jun 17, 2026 Apr 15, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.
CVE-2022-27422 1Chamilo 1Chamilo Lms Jun 17, 2026 Apr 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
CVE-2022-27421 1Chamilo 1Chamilo Lms Jun 17, 2026 Apr 15, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
CVE-2021-40662 1Chamilo 1Chamilo Jun 17, 2026 Mar 21, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.

Previous 1...4 567 8 Next