Skip to content
Noroxi

chamilo records

148 published records for vendor chamilo.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 1.4%
Pre-auth RCE
16
With a fix record
46.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

148 records
  • CVE-2023-34960
    69This week

    A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary comm

    CriticalCVSS 9.8WeaponizedEPSS 99%

    chamilo · chamiloJul 31, 2023

  • CVE-2023-3368
    60This week

    Chamilo LMS Unauthenticated Command Injection

    CriticalCVSS 9.8Proof of conceptEPSS 70%

    chamilo · chamiloNov 28, 2023

  • CVE-2023-4220
    47Plan

    Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

    MediumCVSS 6.1WeaponizedEPSS 76%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2021-34187
    44Plan

    main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    chamilo · chamiloJun 28, 2021

  • CVE-2019-13082
    40Plan

    Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature.

    CriticalCVSS 9.8No exploitEPSS 4%

    chamilo · chamilo lmsJun 30, 2019

  • CVE-2023-3533
    40Plan

    Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write

    CriticalCVSS 9.8No exploitEPSS 3%

    chamilo · chamiloNov 28, 2023

  • CVE-2018-1999019
    40Plan

    Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/

    CriticalCVSS 9.8No exploitEPSS 3%

    chamilo · chamilo lmsJul 23, 2018

  • CVE-2023-3545
    40Plan

    Chamilo LMS Htaccess File Upload Security Bypass

    CriticalCVSS 9.8No exploitEPSS 2%

    chamilo · chamiloNov 28, 2023

  • CVE-2021-35414
    40Plan

    Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    chamilo · chamilo lmsDec 3, 2021

  • CVE-2023-34944
    39Monitor

    An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arb

    CriticalCVSS 9.8No exploitEPSS 1%

    chamilo · chamilo lmsJun 13, 2023

  • CVE-2022-27423
    39Monitor

    Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    chamilo · chamilo lmsApr 15, 2022

  • CVE-2025-50187
    39Monitor

    Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

    CriticalCVSS 9.8No exploitEPSS 1%

    chamilo · chamilo lmsMar 2, 2026

  • CVE-2026-33707
    39Monitor

    Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

    CriticalCVSS 9.8No exploitEPSS 1%

    chamilo · chamilo lmsApr 10, 2026

  • CVE-2026-28430
    37Monitor

    Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php

    CriticalCVSS 9.3No exploitEPSS 1%

    chamilo · chamilo lmsMar 16, 2026

  • CVE-2026-33698
    37Monitor

    Chamilo LMS affected by unauthenticated RCE in main/install folder

    CriticalCVSS 9.3No exploitEPSS 1%

    chamilo · chamilo lmsApr 10, 2026

  • CVE-2023-4222
    36Monitor

    Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 4%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2023-4221
    36Monitor

    Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 4%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2026-32892
    36Monitor

    OS Command Injection in Chamilo LMS 1.11.36

    HighCVSS 8.8No exploitEPSS 3%

    chamilo · chamilo lmsApr 10, 2026

  • CVE-2026-35196
    36Monitor

    Chamilo LMS has OS Command Injection via export_all_certificates action

    HighCVSS 8.8Proof of conceptEPSS 3%

    chamilo · chamilo lmsApr 14, 2026

  • CVE-2021-35413
    36Monitor

    A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute

    HighCVSS 8.8No exploitEPSS 3%

    chamilo · chamilo lmsDec 3, 2021

  • CVE-2023-4226
    36Monitor

    Chamilo LMS File Upload Functionality Remote Code Execution

    HighCVSS 8.8Proof of conceptEPSS 2%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2023-4223
    36Monitor

    Chamilo LMS File Upload Functionality Remote Code Execution

    HighCVSS 8.8No exploitEPSS 2%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2023-4225
    36Monitor

    Chamilo LMS File Upload Functionality Remote Code Execution

    HighCVSS 8.8No exploitEPSS 2%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2023-4224
    36Monitor

    Chamilo LMS File Upload Functionality Remote Code Execution

    HighCVSS 8.8No exploitEPSS 2%

    chamilo · chamilo lmsNov 28, 2023

  • CVE-2025-55208
    36Monitor

    Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files

    CriticalCVSS 9.0No exploitEPSS 0%

    chamilo · chamilo lmsMar 5, 2026