1.9.2

DATE	CVE	VULNERABILITY TITLE	RISK
2019-02-04	CVE-2019-1000015	Cross-site Scripting vulnerability in Chamilo LMS Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. network chamilo CWE-79	4.3
2013-12-05	CVE-2013-6787	SQL Injection vulnerability in Chamilo LMS SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter. network chamilo CWE-89	6.0