CVE-2025-50187 - Vulnerability Analysis

Overview

Chamilo < 1.11.28 contains a remote code execution caused by unfiltered evaluation of SOAP request parameters, letting remote attackers execute arbitrary code, exploit requires sending crafted SOAP requests.

Severity & Score

Impact

Remote attackers can execute arbitrary code, potentially taking full control of the system.

Mitigation

Update to version 1.11.28 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-356v-7xg2-3678

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🔴 CVE-2025-50187 - Critical (9.8) Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50187/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner