Security: chamilo/chamilo-lms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
User enumeration vulnerability via response (<=1.11.34)GHSA-cqr8-vvqp-4mp4 published
Mar 15, 2026 by ywarnierLow -
Authenticated RCE via H5P Import (<=1.11.34)GHSA-mj4f-8fw2-hrfm published
Mar 15, 2026 by ywarnierCritical -
Unauthenticated SQL Injection (<=1.11.32)GHSA-84gw-qjw9-v8jv published
Mar 15, 2026 by ywarnierCritical -
Authenticated Remote Code Execution via Unrestricted File Upload (<=1.11.32)GHSA-4pc3-4w2v-vwx8 published
Mar 5, 2026 by ywarnierHigh -
Validation-less redirect on login page (>1.11.*, <=2.0-beta.1)GHSA-m82x-prv3-rwwv published
Apr 10, 2026 by ywarnierLow -
Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback (<=1.11.32)GHSA-59h4-34mx-m67m published
Mar 5, 2026 by ywarnierModerate -
CSRF Vulnerability in Project Deletion (<=1.11.32)GHSA-rpj6-p9m5-q637 published
Mar 5, 2026 by ywarnierHigh -
Account Takeover via Stored XSS in Course Learning Paths (<=v1.11.32)GHSA-pxrh-3rcp-h7m6 published
Mar 5, 2026 by ywarnierCritical -
Account Takeover via Stored XSS in Course Description (<=1.11.32)GHSA-p32q-6gh3-3gcv published
Mar 5, 2026 by ywarnierCritical -
Stored Cross Site Scripting in Skills Argumentation (<=1.11.32)GHSA-cchj-3qmf-82j5 published
Mar 5, 2026 by ywarnierHigh