CVE-2025-50187

CRITICAL

Chamilo < 1.11.28 - Remote Code Execution via SOAP Request Parameter

Title source: llm

Description

Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-356v-7xg2-3678

Release Notes x_refsource_misc

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28

Scores

CVSS v3 9.8

EPSS 0.0088

EPSS Percentile 54.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-95

Status published

Products (1)

chamilo/chamilo_lms < 1.11.28

Published Mar 02, 2026

Tracked Since Mar 02, 2026