CVEvulnerability
CVE-2025-52482
8.3 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
- Weaknesses
- CWE-79
Description
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.
Affected configurations
• chamilo chamilo lms (< 1.11.30)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/chamilo/chamilo-lms/commit/241c569dde0ad0e34d558ae51271f70438189b0e Patch
- https://github.com/chamilo/chamilo-lms/commit/82cc07edd8ef316e6b36da7c501120d5c0aeb151 Patch
- https://github.com/chamilo/chamilo-lms/commit/f9150075246df4ed9755a4a150e25edb468767be Patch
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 Product, Release Notes
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4wcp-3rh3-7wm4 Exploit, Mitigation, Vendor Advisory