2026

  • cross-course submission comment and grade tampering in chamilo

    ghsa-8423-5658-789h let low-privileged authenticated users in chamilo lms comment on and overwrite grading data for assignment submissions outside their course scope

    b b4r
    August 2, 2026
    2 min read
    vulnerability cve web exploitation idor

  • cross-course blog api authorization bypass in chamilo

    ghsa-438r-9jh4-mmfc let low-privileged chamilo lms users read, create, modify, and comment on blog resources outside their enrolled course scope

    b b4r
    August 1, 2026
    2 min read
    vulnerability cve web exploitation idor

  • openam webauthn deserialization through a shallow filter

    cve-2026-62263 showed that the openam webauthn deserialization filter only constrained the root object, leaving nested gadget graphs unchecked

    b b4r
    July 24, 2026
    3 min read
    vulnerability cve web exploitation deserialization