Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*

3 briefs RSS
high advisory

Chamilo LMS: Unauthenticated remote code execution via arbitrary file upload (CVE-2023-4220)

An unauthenticated arbitrary file upload vulnerability in Chamilo LMS versions 1.11.24 and earlier allows remote attackers to execute arbitrary code by uploading malicious web shells to the bigUpload.php endpoint.

Chamilo LMS web-application-vulnerability remote-code-execution file-upload chamilo
1r 1t 1c
critical advisory

Chamilo LMS CStudio Unauthenticated Remote Code Execution

An unauthenticated remote code execution vulnerability in the Chamilo LMS CStudio upload flow allows attackers to gain server-level access by exploiting improper file handling (CVE-2026-45140).

PoC Chamilo LMS remote-code-execution web-application critical-vulnerability
1r 2t 1c updated
critical advisory

Chamilo LMS OS Command Injection Vulnerability (CVE-2026-35196)

Chamilo LMS versions prior to 2.0.0-RC.3 are vulnerable to OS Command Injection via the _cid session variable in the export_all_certificates action, potentially leading to arbitrary command execution.

PoC cve-2026-35196 os command injection chamilo lms web application
2r 1t 1c updated