Chamilo has 6 CVEs on record between 2021 and 2026. 4 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 6.1 (medium), with 2 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (4). Most affected products: chamilo-lms (3), LMS (1), chamilo (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- chamilo-lms 3
- LMS 1
- chamilo 1
- chamilo_lms 1
Worst active — by depth score
CVE-2026-45140Critical· 9.8Chamilo LMS is an open-source learning management system66CVE-2026-45143Critical· 9.0Chamilo LMS is an open-source learning management system50CVE-2026-82535Medium· 6.1Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypas…34CVE-2021-43687Medium· 6.1chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.34CVE-2026-112031Low· 3.5Chamilo LMS Ticket TicketManager.php addProject cross site scripting19
Chamilo vulnerabilities
CVEs affecting Chamilo, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-112031Low· 3.5Chamilo LMS Ticket TicketManager.php addProject cross site scripting
A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the…
CVE-2026-45143Critical· 9.0Chamilo LMS is an open-source learning management system
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue a…
CVE-2026-45140Critical· 9.8PoCChamilo LMS is an open-source learning management system
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, …
CVE-2026-82535Medium· 6.1Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypas…
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypas…
CVE-2025-66447None· 0.0Chamilo LMS is a learning management system
Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.
CVE-2021-43687Medium· 6.1chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.
chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.