PHP CVE-2025-50198

MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-02 security-advisories@github.com

PHP Deserialization Chamilo Lms

4.9

CVSS 3.1 · GitHub Advisory

Share

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

4

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 03, 2026 - 19:42 vuln.today

Public exploit code

Patch released

Mar 03, 2026 - 19:42 nvd

Patch available

CVE Published

Mar 02, 2026 - 16:16 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.

AnalysisAI

Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. [CVSS 4.9 MEDIUM]

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects Chamilo Lms. Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.11.30.. Restrict network access to the affected service where possible.

More in PHP

View all

CVE-2012-1823 CRITICAL Act Now POC

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2024-11680 CRITICAL Act Now POC

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-46506 CRITICAL Emergency POC

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro

CVE-2024-8353 CRITICAL Act Now POC

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

CVE-2020-10189 CRITICAL POC

CVE-2019-18935 CRITICAL POC

CVE-2015-7450 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

CVE-2021-42237 CRITICAL POC

CVE-2025-24016 CRITICAL POC

Same technique Deserialization

View all

CVE-2015-7450 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

CVE-2021-42237 CRITICAL POC

CVE-2025-24016 CRITICAL POC

CVE-2015-4852 CRITICAL POC

CVE-2025-49113 CRITICAL POC

CVE-2017-3066 CRITICAL POC

Share

CVE-2025-50198 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy