CVE-2025-52564
MEDIUMChamilo <1.11.30 - XSS
Title source: llmDescription
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
Scores
CVSS v3
6.1
EPSS
0.0003
EPSS Percentile
9.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-80
Status
published
Affected Products (1)
chamilo/chamilo_lms
< 1.11.30
Timeline
Published
Mar 02, 2026
Tracked Since
Mar 02, 2026