by Kastro
Paper/Archive/CVE-2025-50187

CVE-2025-50187

chamilo chamilo-lms — Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.8.628 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

Affected

ProductAffectedFixed inSource
chamilo-lms< 1.11.28–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/chamilo/chamilo-lms/security/advisories/GHSA-356v-7xg2-3678refgithub.com/chamilo/chamilo-lms/releases/tag/v1.11.28