Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days

Quarkslab audited Chamilo LMS and found multiple 0-days, including an unauthenticated SQL injection, chaining them into a full pre-auth RCE; eleven CVE-2026 IDs were assigned and fixed by the vendor.