CVE-2025-50191Disclosure(chamilo / chamilo_lms)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.

chamilo CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/chamilo/chamilo-lms/commit/06155f128395acc6745af826150a0bb2b4a68496

Exploit / PoC references

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-82qx-25j7-5639

Other references

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chamilo_lms

Threat summary

5 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 3d ago at 2 mentions (2026-03-02); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

chamilo

Products

chamilo_lms

Deep dive

Activity timeline5 mentions / 4d

Signal classification1 categories

Disclosure

5100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	2	Disclosure2
2026-03-05	1	Disclosure1
2026-03-06	1	Disclosure1
2026-03-07	1	Disclosure1

Full discourse5 posts

CRAC Learning - Tech@cracbot215d
Disclosure
CVE-2025-50191 (CVSS:7.0, HIGH) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFi..https://nvd.nist.gov/vuln/detail/CVE-2025-50191 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2025-50191, an error‑based SQL injection in Chamilo LMS (versions <1.11.30) with a CVSS score of 7.0, but offers no PoC, exploit, patch, or evidence of active exploitation.
0000097
173 followersView on X
CRAC Learning - Tech@cracbot216d
Disclosure
CVE-2025-50191 (CVSS:7.0, HIGH) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFi..https://nvd.nist.gov/vuln/detail/CVE-2025-50191 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post provides a brief technical overview of CVE‑2025‑50191, noting its CVSS score, type of vulnerability, and affected Chamilo version.
0000039
173 followersView on X
CRAC Learning - Tech@cracbot217d
Disclosure
CVE-2025-50191 (CVSS:7.0, HIGH) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFi..https://nvd.nist.gov/vuln/detail/CVE-2025-50191 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post reports CVE‑2025‑50191, noting it is a CVSS 7.0 high‑severity error‑based SQL injection affecting Chamilo before version 1.11.30, but gives no proof‑of‑concept, exploitation tool, or mitigation details.
0000028
173 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds219d
Disclosure
CVE-2025-50191 SQL Injection Vulnerability in Chamilo LMS Prior to Version 1.11.30 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-50191
Post summary
A SQL injection vulnerability (CVE-2025-50191) affects Chamilo LMS versions before 1.11.30.
0000078
4.0K followersView on X
CVE@CVEnew220d
Disclosure
CVE-2025-50191 Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php scr… https://www.cve.org/CVERecord?id=CVE-2025-50191
Post summary
The post announces an error‑based SQL injection vulnerability in Chamilo (pre‑1.11.30) affecting the /main/exercise/hotpotatoes.php endpoint via POST userFile.
00000181
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chamilo	chamilo_lms	-	-	-

Explore more

Back to dashboard chamilo CVEs chamilo_lms vulnerabilities

What researchers are saying

CVE-2025-50191

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2025-50191, an error‑based SQL injection in Chamilo LMS (versions <1.11.30) with a CVSS score of 7.0, but offers no PoC, exploit, patch, or evidence of active exploitation.

CRAC Learning - Tech@cracbotDisclosure

The post provides a brief technical overview of CVE‑2025‑50191, noting its CVSS score, type of vulnerability, and affected Chamilo version.

CRAC Learning - Tech@cracbotDisclosure

The post reports CVE‑2025‑50191, noting it is a CVSS 7.0 high‑severity error‑based SQL injection affecting Chamilo before version 1.11.30, but gives no proof‑of‑concept, exploitation tool, or mitigation details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A SQL injection vulnerability (CVE-2025-50191) affects Chamilo LMS versions before 1.11.30.

CVE@CVEnewDisclosure

The post announces an error‑based SQL injection vulnerability in Chamilo (pre‑1.11.30) affecting the /main/exercise/hotpotatoes.php endpoint via POST userFile.