2 CVEs
CRITICAL
CVSS 9.8
Chamilo LMS Deserialization Vulnerabilities
2026-03-02
CVE-2025-52998
CRITICAL
PATCH
Chamilo LMS prior to 1.11.30 has an insecure deserialization vulnerability enabling remote code execution through crafted serialized data.
9.8
CVSS
0.1%
EPSS
CVE-2025-50198
MEDIUM
POC
PATCH
Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. [CVSS 4.9 MEDIUM]
4.9
CVSS
0.1%
EPSS