Chamilo LMS Multiple Command Injection Security Advisory (5 CVEs)

CVE-2025-50196 HIGH POC PATCH

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. [CVSS 7.2 HIGH]

7.2

CVSS

0.5%

EPSS

CVE-2025-50194 HIGH POC PATCH

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. [CVSS 7.2 HIGH]

7.2

CVSS

0.6%

EPSS

CVE-2025-50197 HIGH POC PATCH

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. [CVSS 7.2 HIGH]

7.2

CVSS

0.6%

EPSS

CVE-2025-50193 HIGH POC PATCH

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. [CVSS 7.2 HIGH]

7.2

CVSS

0.6%

EPSS

CVE-2025-50195 HIGH POC PATCH

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. [CVSS 7.2 HIGH]

7.2

CVSS

0.6%

EPSS