Lms

An unauthenticated IDOR vulnerability in the LearnPress WordPress plugin allows unauthorized access to private course materials by manipulating the course and item identifiers in AJAX requests.

An unauthenticated server-side request forgery (SSRF) vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3, allowing attackers to probe internal network services, access cloud metadata, or trigger state-changing operations on internal services.

Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 are vulnerable to a weak password reset mechanism, allowing attackers to compute password reset tokens using only a user's email address due to the use of SHA1 hashing without randomization, expiration, or rate limiting, leading to unauthorized account takeover.

A Server-Side Request Forgery (SSRF) vulnerability exists in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3, allowing authenticated attackers to make arbitrary HTTP requests, scan internal ports, and access cloud instance metadata via the Social Wall feature.

Chamilo LMS before versions 1.11.38 and 2.0.0-RC.3 is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to modify the learning path progress of other users by manipulating the 'uid' parameter in the lp_ajax_save_item.php endpoint.

An Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS (CVE-2026-32930) allows authenticated teachers to modify gradebook evaluation settings of other courses by manipulating the 'editeval' GET parameter, leading to unauthorized data modification.

Chamilo LMS versions prior to 1.11.38 are vulnerable to remote code execution via arbitrary file upload by authenticated users due to insufficient file extension filtering in the BigUpload endpoint, allowing execution of PHP code on servers configured to process .pht files.