https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T19:34:37.485411+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-20977 cnvd-2019-20977 2026-10-21T19:34:37.488743+00:00 cnvd-2019-20977 https://cve.radiocsirt.org/vuln/euvd-2026-55444 EUVD-2026-55444 2026-10-21T19:34:37.488777+00:00 EUVD-2026-55444 https://cve.radiocsirt.org/vuln/fkie_cve-2019-13082 fkie_cve-2019-13082 2026-10-21T19:34:37.488791+00:00

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

 https://cve.radiocsirt.org/vuln/ghsa-g23x-7c6x-9f5m GHSA-g23x-7c6x-9f5m 2026-10-21T19:34:37.488822+00:00

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

 https://cve.radiocsirt.org/vuln/gsd-2019-13082 gsd-2019-13082 2026-10-21T19:34:37.488841+00:00 gsd-2019-13082