The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewp_affiliate_url' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Mojic versions prior to 2.1.4 contain a timing side-channel vulnerability in the CipherEngine's HMAC-SHA256 integrity verification. The use of a standard equality operator (! ==) during decryption causes an observable timing discrepancy (CWE-208), which could allow an attacker to bypass the file integrity check via timing analysis. This vulnerability has a medium severity rating and a CVSS score of 4.7. The issue is fixed in version 2.1.4.
CVE-2026-41175 is a high-severity vulnerability in Statamic CMS versions prior to 5.73.20 and 6.13.0 involving unsafe reflection (CWE-470). It allows manipulation of query parameters on Control Panel and REST API endpoints or GraphQL queries to delete content, assets, and user accounts. Exploitation via the Control Panel requires authentication with minimal permissions, while REST and GraphQL API exploitation requires these APIs to be explicitly enabled without authentication. The vulnerability has been fixed in versions 5.73.20 and 6.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an improper privilege management vulnerability in the PUT /api/users/{id} endpoint. Authenticated users with the ROLE_STUDENT can escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. This is due to insufficient authorization checks and the roles field being writable. Exploitation grants full administrative control over the platform, including access to all courses, user data, grades, and administrative settings. The vulnerability has been fixed in version 2.0.0-RC.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an OS Command Injection vulnerability in the gradebook.ajax.php endpoint. The vulnerability arises because the course code from the session variable is directly concatenated into a shell_exec() command without proper sanitization. An attacker able to manipulate session data can inject shell metacharacters, leading to arbitrary command execution on the server. This can result in full system compromise, including reading sensitive files, altering the application or database, and disrupting server availability. The issue is fixed in version 2.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an authorization bypass vulnerability in the /api/course_rel_users endpoint. An authenticated attacker can manipulate the user parameter to enroll arbitrary users into courses without proper authorization. This occurs because the backend does not verify ownership or permission for the user ID supplied. The vulnerability allows unauthorized access to course materials and compromises enrollment controls. The issue is fixed in version 2.0.0-RC.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an Insecure Direct Object Reference (IDOR) vulnerability in the notebook module. This flaw allows any authenticated student to access private course notes of other users by manipulating the notebook_id parameter in the editnote action. The application does not verify ownership when reading notes, exposing the full title and HTML content to unauthorized users. Ownership checks exist only for updating or deleting notes, not for reading them. This vulnerability has been fixed in version 2.0.0-RC.
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the PENS plugin endpoint. This endpoint accepts a user-controlled URL parameter that the server fetches without filtering internal or private IP addresses. Exploitation allows attackers to probe internal network services, access cloud metadata endpoints to steal credentials, or trigger state-changing operations on internal services without authentication. The issue has been fixed in version 2.0.0-RC.3.
Chamilo LMS version 2.0-RC.2 contains a vulnerability where a critical AJAX endpoint (install.ajax.php) is accessible without authentication. This endpoint's test_mailer action accepts arbitrary SMTP server details from unauthenticated POST requests, enabling Server-Side Request Forgery (SSRF) and abuse as an open email relay. This can lead to phishing and spam campaigns originating from the server and may disclose internal network information through error messages. The issue is fixed in version 2.0.0-RC.
Chamilo LMS version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint. This vulnerability is due to incomplete sanitization of the date_start and date_end parameters in the users_active action, allowing an authenticated admin to perform time-based blind SQL injection. The issue was fixed in version 2.0.0. The vulnerability has a CVSS score of 7.1, indicating high severity.
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.
Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38.