PT-2026-23632 · Chamilo · Chamilo

CVE-2025-59540 · Publicado 2026-03-06 · Atualizado 2026-03-06

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system. A stored cross-site scripting (XSS) issue exists that allows a staff account to execute arbitrary JavaScript in the browser of admin users with higher privileges. The issue occurs because feedback input on the exercise history page is not properly encoded before rendering, enabling malicious scripts to persist in the database and execute when viewed. The vulnerable component is the rendering of feedback input.

Recommendations Update to version 1.11.34 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2025-59540

GHSA-59H4-34MX-M67M

Produtos afetados

Chamilo

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59540.json · Exploit
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-59h4-34mx-m67m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59540 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-59540 · Aviso do Fabricante