CVE-2024-50337

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-503387.4Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential prot CVE-2024-503395.3GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can CVE-2024-50348.8The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perfor CVE-2024-503407.3symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_a CVE-2024-503413.1symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Sym CVE-2024-503424.3symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asyn CVE-2024-503433.1symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` CVE-2024-503444.6I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have CVE-2024-503456.1symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `R CVE-2024-503465.1WebFeed is a lightweight web feed reader extension for Firefox/Chrome. Multiple HTML injection vulnerabilities in WebFeed can lead to CSRF a CVE-2024-503476.3Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verifi CVE-2024-503485.4InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validatio