PT-2026-22621 · Chamilo · Chamilo

CVE-2025-52564 · Publicado 2026-03-02 · Atualizado 2026-03-02

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. The open parameter in the help.php file does not properly sanitize user-supplied input. This allows an attacker to inject arbitrary HTML through a specially crafted URL. The vulnerable parameter is open.

Recommendations Update to version 1.11.30 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

CVE-2025-52564

GHSA-6FMM-QRX4-WGQC

Produtos afetados

Chamilo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52564.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b · Correção
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6fmm-qrx4-wgqc · Aviso do Fabricante
• https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2 · Correção
• https://twitter.com/cyberbivash/status/2028509887014060229 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-52564 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2028512275418546595 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028510373037453545 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-52564 · Nota de Segurança