SQL Injection

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. Chamilo model.ajax.php - SQL InjectionCVE-2021-34187Chamilo · 16% likely

   CWE-89

2. SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at insta…CVE-2013-6787Chamilo · 2.7% likely

   CWE-89

3. Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.CVE-2021-35414Chamilo · 1.9% likely

   CWE-89

4. Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be…CVE-2018-20329Chamilo · 1.2% likely

   CWE-89

5. Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.CVE-2022-27423Chamilo · 1.0% likely

   CWE-89

6. Chamilo: Error-based SQL InjectionCVE-2025-50189chamilo · CVSS 7.2 · 0.8% likely

   CWE-89

7. Error-based SQL Injection in Chamilo LMSCVE-2025-50188chamilo · CVSS 7 · 0.8% likely

   CWE-89

8. SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.CVE-2023-39582Chamilo · 0.7% likely

   CWE-89

9. Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.phpCVE-2025-50192chamilo · CVSS 8.8 · 0.7% likely

   CWE-89

10. Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php scriptCVE-2025-50190chamilo · CVSS 8.8 · 0.7% likely

    CWE-89

11. Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php scriptCVE-2025-50191chamilo · CVSS 7 · 0.6% likely

    CWE-89

12. Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpCVE-2026-28430chamilo · CVSS 9.3 · 0.4% likely

    CWE-89

13. Chamilo LMS: SQL Injection in the statistics AJAX endpointCVE-2026-30881chamilo · CVSS 8.8 · 0.3% likely

    CWE-89

14. Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificatedCVE-2026-45146chamilo · CVSS 7.2 · 0.3% likely

    CWE-89

15. Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)CVE-2026-33714chamilo · CVSS 7.1 · 0.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.