CVE-2025-50199

Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.

• CWE-918

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-jv2w-m5r6-p52hExploit, Mitigation, Vendor Advisory

Published

Mar 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50193Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50194Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50195Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50196Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50197Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50198Chamilo is a learning management system. Prior to version 1.…4.9
• CVE-2025-5020Opening maliciously-crafted URLs in Firefox from other apps …4.3
• CVE-2025-50200RabbitMQ is a messaging and streaming broker. In versions 3.…5.5
• CVE-2025-50201WeGIA is a web manager for charitable institutions. Prior to…9.8
• CVE-2025-50202Lychee is a free photo-management tool. In versions starting…7.5
• CVE-2025-50213Failure to Sanitize Special Elements into a Different Plane …9.8
• CVE-2025-5022Weak Password Requirements vulnerability in Mitsubishi Elect…6.5