Technology · Chamilo
Chamilo Lms vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 42 vulnerabilities in Chamilo Lms: 0 in the last 7 days and 9 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45146, was published on 3 November 2026. 8 vulnerabilities in the last four weeks, up 700% on the four before (1). 0 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 9
- Critical, all time
- 5
- Exploited in the wild
- 0
About Chamilo Lms
Chamilo LMS is an open-source learning management system for creating online courses and educational content.
Latest Chamilo Lms vulnerabilities
- CVE-2026-45146: Chamilo LMS SQL injection via groupOp parameterhighCVSS 7.2
- CVE-2026-45145: Chamilo LMS unsafe deserialization in career datahighCVSS 7.5
- CVE-2026-45144: Chamilo LMS stored XSS in user profile fieldshighCVSS 8.9
- CVE-2026-45141: Chamilo LMS CSRF in skill management AJAXmediumCVSS 6.5
- CVE-2026-44344: Chamilo LMS arbitrary code execution in HTML_QuickFormmediumCVSS 6.6
- CVE-2026-114390: Chamilo LMS missing authorization in legacy AJAX handlersmediumCVSS 5.3
- CVE-2026-114389: Chamilo LMS missing authorization in AiControllermediumCVSS 4.3
- CVE-2026-114388: Chamilo LMS missing access control in GradebookControllermediumCVSS 5.3
- CVE-2026-45140: Chamilo LMS CStudio upload flow unauthenticated remote code executioncriticalCVSS 9.8EPSS 1.3%
- CVE-2026-39878: Chamilo LMS stored XSS in user registration formcriticalCVSS 9.3
- CVE-2026-34239: Chamilo LMS remote code execution in lang.ajax.phpinfoCVSS 7.5
- CVE-2026-40291: Chamilo LMS privilege escalation in API user role modificationhighCVSS 8.8EPSS 0.3%
- CVE-2026-35196: Chamilo LMS OS command injection in gradebook certificate exporthighCVSS 8.8EPSS 1.8%
- CVE-2026-34602: Chamilo LMS IDOR in course enrollment APIhighCVSS 7.1EPSS 0.2%
- CVE-2026-34370: Chamilo LMS IDOR in notebook modulemediumCVSS 6.5EPSS 0.2%
- CVE-2026-34161: Chamilo LMS Stored XSS in social post attachmentsmediumCVSS 5.4EPSS 0.2%
- CVE-2026-34160: Chamilo LMS unauthenticated SSRF in PENS pluginhighCVSS 8.6EPSS 0.3%
- CVE-2026-33715: Chamilo LMS SSRF and open email relay in install.ajax.phphighCVSS 7.2EPSS 0.2%
- CVE-2026-33714: Chamilo LMS SQL injection in statistics AJAX endpointhighCVSS 7.2EPSS 0.3%
- CVE-2026-33737: Chamilo LMS XML External Entity injection in multiple componentsmediumCVSS 5.3
- CVE-2026-33736: Chamilo LMS authorization bypass in User APImediumCVSS 6.5
- CVE-2026-33710: Chamilo LMS predictable REST API key generationhighCVSS 7.5
- CVE-2026-33708: Chamilo LMS information disclosure in REST APImediumCVSS 6.5
- CVE-2026-33707: Chamilo LMS weak password recovery mechanism in login.lib.phpcriticalCVSS 9.4
- CVE-2026-33706: Chamilo LMS privilege escalation in REST APIhighCVSS 7.1
Most severe Chamilo Lms vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-45140: Chamilo LMS CStudio upload flow unauthenticated remote code executioncriticalCVSS 9.8EPSS 1.3%
- CVE-2026-33698: Chamilo LMS unauthenticated RCE in main/install directorycriticalCVSS 9.8
- CVE-2026-33707: Chamilo LMS weak password recovery mechanism in login.lib.phpcriticalCVSS 9.4
- CVE-2026-39878: Chamilo LMS stored XSS in user registration formcriticalCVSS 9.3
- CVE-2026-32892: Chamilo LMS OS command injection in file move functioncriticalCVSS 9.1
- CVE-2026-45144: Chamilo LMS stored XSS in user profile fieldshighCVSS 8.9
- CVE-2026-35196: Chamilo LMS OS command injection in gradebook certificate exporthighCVSS 8.8EPSS 1.8%
- CVE-2026-40291: Chamilo LMS privilege escalation in API user role modificationhighCVSS 8.8EPSS 0.3%
- CVE-2026-33618: Chamilo LMS eval injection in PlatformConfigurationControllerhighCVSS 8.8
- CVE-2026-34160: Chamilo LMS unauthenticated SSRF in PENS pluginhighCVSS 8.6EPSS 0.3%
Vulnerabilities per week
8 vulnerabilities in the last four weeks, up 700% on the four before (1). 0 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 1 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 3 | 0 | |
| 26 Oct 2026 | 4 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Chamilo Lms vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/chamilo-lms)<a href="https://junglewise.ai/threats/technologies/chamilo-lms"><img src="https://junglewise.ai/threats/technologies/chamilo-lms/badge.svg" alt="Chamilo Lms vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/chamilo-lms.json, and this page as text at https://junglewise.ai/threats/technologies/chamilo-lms.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Chamilo Lms vulnerabilities", https://junglewise.ai/threats/technologies/chamilo-lms, 11 November 2026.