CVE-2025-26153

Summary

A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute when victims, such as administrators, reply to the message.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://gist.github.com/NoSpaceAvailable/234acdf57b5d7b29b2f39090c1686bc8

References

• https://github.com/chamilo/chamilo-lms/commit/beb07770d674fcc9db6df0e59aab107678c28682
• https://github.com/chamilo/chamilo-lms/commit/d5c29cf39ac30d7364a52bba4036c3e870412066
• https://gist.github.com/NoSpaceAvailable/234acdf57b5d7b29b2f39090c1686bc8

• ←Previous
• Next→