CVE-2025-50192Disclosure(chamilo / chamilo_lms)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch chamilo chamilo_lms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.

chamilo CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/chamilo/chamilo-lms/commit/fd0f2a95b21fa28da47d785c88b879a77951b0f7

Exploit / PoC references

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-g389-qq92-qxxf

Other references

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chamilo_lms

Threat summary

Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 5 classified signals
Peaked 4d ago at 2 mentions (2026-03-02); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

chamilo

Products

chamilo_lms

Deep dive

Activity timeline6 mentions / 5d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	2	Disclosure2
2026-03-04	1	Patch1
2026-03-05	1	Disclosure1
2026-03-06	1	Disclosure1
2026-03-07	1	Disclosure1

Full discourse6 posts

CRAC Learning - Tech@cracbot215d
Disclosure
CVE-2025-50192 (CVSS:8.8, CRITICAL) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main..https://nvd.nist.gov/vuln/detail/CVE-2025-50192 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces CVE‑2025‑50192, a time‑based SQL injection affecting Chamilo before v1.11.30, and provides basic technical details and the CVSS score.
0000099
173 followersView on X
CRAC Learning - Tech@cracbot216d
Disclosure
CVE-2025-50192 (CVSS:8.8, CRITICAL) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main..https://nvd.nist.gov/vuln/detail/CVE-2025-50192 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces a critical time‑based SQL injection in versions of Chamilo before 1.11.30, providing CVSS and CVE references but no PoC, exploit code, patch, or evidence of active exploitation.
0000039
173 followersView on X
CRAC Learning - Tech@cracbot217d
Disclosure
CVE-2025-50192 (CVSS:8.8, CRITICAL) is Analyzed. Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main..https://nvd.nist.gov/vuln/detail/CVE-2025-50192 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post identifies CVE-2025-50192 as a critical, time-based SQL injection in Chamilo before version 1.11.30, but it does not provide any PoC, exploit code, patch information, or evidence of active exploitation.
0000030
173 followersView on X
The Hacker Wire@TheHackerWire218d
Patch
🔴 CVE-2025-50192 - Critical Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in ... https://www.thehackerwire.com/vulnerability/CVE-2025-50192/ https://t.co/lJ2Rx8ot3t
Post summary
The post reports a time‑based SQL injection in Chamilo’s registration SOAP endpoint, notes it was fixed in version 1.11.30, but provides no exploit or PoC details.
0000084
121 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
Disclosure
CVE-2025-50192 Time-Based SQL Injection in Chamilo LMS Before Version 1.11.30 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-50192
Post summary
The post announces a time‑based SQL injection vulnerability in Chamilo LMS versions before 1.11.30, identified as CVE‑2025‑50192.
0000085
4.0K followersView on X
CVE@CVEnew220d
Disclosure
CVE-2025-50192 Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue… https://www.cve.org/CVERecord?id=CVE-2025-50192
Post summary
The post announces a time‑based SQL injection vulnerability in Chamilo's registration SOAP endpoint, affecting versions before 1.11.30.
00000164
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chamilo	chamilo_lms	-	-	-

Explore more

Back to dashboard chamilo CVEs chamilo_lms vulnerabilities

What researchers are saying

CVE-2025-50192

CRAC Learning - Tech@cracbotDisclosure

The tweet announces CVE‑2025‑50192, a time‑based SQL injection affecting Chamilo before v1.11.30, and provides basic technical details and the CVSS score.

CRAC Learning - Tech@cracbotDisclosure

The post announces a critical time‑based SQL injection in versions of Chamilo before 1.11.30, providing CVSS and CVE references but no PoC, exploit code, patch, or evidence of active exploitation.

CRAC Learning - Tech@cracbotDisclosure

The post identifies CVE-2025-50192 as a critical, time-based SQL injection in Chamilo before version 1.11.30, but it does not provide any PoC, exploit code, patch information, or evidence of active exploitation.

The Hacker Wire@TheHackerWirePatch

The post reports a time‑based SQL injection in Chamilo’s registration SOAP endpoint, notes it was fixed in version 1.11.30, but provides no exploit or PoC details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a time‑based SQL injection vulnerability in Chamilo LMS versions before 1.11.30, identified as CVE‑2025‑50192.

CVE@CVEnewDisclosure

The post announces a time‑based SQL injection vulnerability in Chamilo's registration SOAP endpoint, affecting versions before 1.11.30.