Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,384 results · page 86 of 348
Mar 4, 2026A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attackCVE-2026-20002 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.1
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain full access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials.
- Product
- Cisco Secure Firewall Management Center (FMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Mar 4, 2026A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected systeCVE-2026-20001 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles: Administrator Security approver Access admin Network admin
- Product
- Cisco Secure Firewall Management Center (FMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-29069 · Other software · craftcms · reported by GitHubMedium 6.9
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28784 · Other software · craftcms · reported by GitHubHigh 8.6
Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comgithub.com
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28783 · Other software · craftcms · reported by GitHubCritical 9.4
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28782 · Other software · craftcms · reported by GitHubMedium 5.3
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28781 · Other software · craftcms · reported by GitHubHigh 7.1
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28697 · Other software · craftcms · reported by GitHubCritical 9.4
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28696 · Other software · craftcms · reported by GitHubHigh 8.7
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Craft is a content management system (CMS).CVE-2026-28695 · Other software · craftcms · reported by GitHubHigh 7.5
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability.CVE-2026-22760 · Other software · Dell · reported by security_alert@emc.comLow 3.3
Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service.
- Product
- Device Management Agent (DDMA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability.CVE-2026-22285 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized Access.
- Product
- Device Management Agent (DDMA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex CVE-2026-28774 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.3
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.
- Product
- SFX Series SuperFlex SatelliteReceiver Web Management Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web ManagemenCVE-2026-28773 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.3
The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe `|` operator) to append and execute arbitrary shell commands with root privileges.
- Product
- SFX Series SuperFlex SatelliteReceiver Web Management Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex CVE-2026-28772 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceMedium 5.1
A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute arbitrary web scripts or HTML. The vulnerability is triggered by sending a crafted payload through the `submitType` parameter, which is reflected directly into the DOM without proper escaping.
- Product
- SFX Series SuperFlex SatelliteReceiver Web Management Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelCVE-2026-28771 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceMedium 5.1
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.
- Product
- SFX Series SuperFlex Satellite Receiver Web Management Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex SatelCVE-2026-28770 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceMedium 5.3
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible
- Product
- SFX Series SuperFlex Satellite Receiver Web management interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite RCVE-2026-28769 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceMedium 5.3
A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.
- Product
- SFX Series SuperFlex Satellite Receiver Web management interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2026-27012 · Other software · devcode-it · reported by GitHubCritical 9.8
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25146 · Other software · openemr · reported by GitHubCritical 9.6
OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24898 · Other software · openemr · reported by GitHubCritical 10
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24848 · Other software · openemr · reported by GitHubHigh 8.7
OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem. This vulnerability can be exploited to achieve Remote Code Execution (RCE) by uploading malicious PHP web shells.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2026-24415 · Other software · devcode-it · reported by GitHubMedium 5.1
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly vaCVE-2026-2606 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.
- Product
- webMethods API Gateway (on-prem)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissioCVE-2025-13734 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissions.
- Product
- Engineering Requirements Management DOORS Next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication.CVE-2026-22886 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.
- Product
- Eclipse OpenMQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52998 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52564 · Other software · chamilo · reported by GitHubMedium 6.9
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52563 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52476 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization of the keyword_active parameter in admin/user_list.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52475 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php endpoint. The keyword_inactive parameter is not properly sanitized, allowing attackers to inject malicious JavaScript through a crafted URL. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52470 · Other software · chamilo · reported by GitHubMedium 4.8
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScript payloads. The injected script is later executed when accessing add_many_sessions_to_category.php, potentially compromising administrative sessions. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52469 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52468 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50199 · Other software · chamilo · reported by GitHubHigh 7.7
Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50198 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50197 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50196 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50195 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50194 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50193 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52482 · Other software · chamilo · reported by GitHubHigh 8.3
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50192 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50191 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50190 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50189 · Other software · chamilo · reported by GitHubHigh 7.2
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50188 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50187 · Other software · chamilo · reported by GitHubCritical 9.8
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50186 · Other software · chamilo · reported by GitHubMedium 4.8
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2024-50337 · Other software · chamilo · reported by GitHubMedium 5.3
Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.