# Chamilo Chamilo Lms


- [CVE-2025-50187](https://insights.sbomify.com/CVE-2025-50187/): Chamilo: Evaluation of untrusted user input leads to Remote Code Execution (critical 9.8)
- [CVE-2023-34944](https://insights.sbomify.com/CVE-2023-34944/): File upload in n/a (critical 9.8)
- [CVE-2022-27423](https://insights.sbomify.com/CVE-2022-27423/): SQL injection in n/a (critical 9.8)
- [CVE-2021-35414](https://insights.sbomify.com/CVE-2021-35414/): SQL injection in n/a (critical 9.8)
- [CVE-2019-13082](https://insights.sbomify.com/CVE-2019-13082/): File upload in n/a (critical 9.8)
- [CVE-2018-1999019](https://insights.sbomify.com/CVE-2018-1999019/): Deserialization in n/a (critical 9.8)
- [CVE-2026-33707](https://insights.sbomify.com/CVE-2026-33707/): Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms (critical 9.4)
- [CVE-2026-33698](https://insights.sbomify.com/CVE-2026-33698/): Chamilo LMS affected by unauthenticated RCE in main/install folder (critical 9.3)
- [CVE-2026-28430](https://insights.sbomify.com/CVE-2026-28430/): Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php (critical 9.3)
- [CVE-2026-32892](https://insights.sbomify.com/CVE-2026-32892/): OS Command Injection in Chamilo LMS 1.11.36 (critical 9.1)
- [CVE-2025-59542](https://insights.sbomify.com/CVE-2025-59542/): Chamilo: Account Takeover via Stored XSS in Course Learning Paths (critical 9.1)
- [CVE-2025-59543](https://insights.sbomify.com/CVE-2025-59543/): Chamilo: Account Takeover via Stored XSS in Course Description (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/chamilo/chamilo-lms/