Chamilo LMS — Cyber Threats, Attacks & Incidents

Related Threat Clusters

• Critical XSS Vulnerability in Chamilo LMS Leads to Admin Account Takeover

  A critical stored cross-site scripting vulnerability, CVE-2026-39878, was discovered in Chamilo LMS versions 1.11.38 and earlier. This flaw allows unauthenticated attackers to execute arbitrary JavaScript in an…

  3 articles · Updated July 21, 2026
• Critical Vulnerability CVE-2026-33707 in Chamilo LMS Allows Account Takeover

  CVE-2026-33707 is a critical vulnerability affecting Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3. The flaw arises from a weak password reset mechanism that generates predictable tokens using sha1($email)…

  2 articles · Updated April 11, 2026

Recent Intelligence Reports

• CVE-2026-39878 - Chamilo stored XSS via user registration leads to admin account takeover Latest Vulnerabilities / 16h CVE ID : CVE-2026-39878 Published : July 20, 2026, 6:16 p.m. 39 minutes ago Description : Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This ha — cvefeed.io · July 21, 2026
• CVE-2026-39878 - Exploits & Severity — Feedly · July 21, 2026
• CVE-2026-33707 TheHackerWire / 18h Attack Vector How the vulnerability can be exploited Network Scope Impact beyond vulnerable component Unchanged — www.thehackerwire.com · April 11, 2026
• CVE-2026-33707 - Exploits & Severity — Feedly · April 11, 2026

Related Entities