Security: chamilo/chamilo-lms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Stored Cross Site Scripting on Social Networks Uploaded Files (<=1.11.32)GHSA-2vq2-826h-6hp6 published
Mar 5, 2026 by ywarnierCritical -
Unauthorised access to update category of any user (<=1.11.32)GHSA-x3h9-h7qf-wwrf published
Mar 5, 2026 by ywarnierHigh -
PHAR deserialization bypass (<=1.11.28)GHSA-6mwg-2mw5-rx5v published
Mar 2, 2026 by ywarnierHigh -
Stored Cross-Site Scripting (XSS) via Session Category Name (<= 1.11.28)GHSA-p4m6-gwhg-x89f published
Mar 2, 2026 by ywarnierModerate -
Stored XSS via Malicious CSV Filename in user_import.php (<=1.11.28)GHSA-wrx6-5v5r-mmgx published
Mar 2, 2026 by ywarnierModerate -
Friend Request Workflow Bypass in Chamilo - Unauthorized Friend Addition and ID Validation Bypass (<= 1.11.28)GHSA-m5xj-5xf3-rqch published
Mar 2, 2026 by ywarnierHigh -
Stored XSS Vulnerability via CSV User Import (<=1.11.28)GHSA-hc3c-8p55-xh4r published
Mar 2, 2026 by ywarnierHigh -
HTML injection via open parameter (<=1.11.28)GHSA-6fmm-qrx4-wgqc published
Mar 2, 2026 by ywarnierLow -
Reflected XSS via keyword_active parameter (<=1.11.28)GHSA-pqjc-rvr9-w8m2 published
Mar 2, 2026 by ywarnierModerate -
Reflected XSS via keyword_inactive parameter (<=1.11.28)GHSA-7p5f-34rx-49h8 published
Mar 2, 2026 by ywarnierModerate