PT-2026-25807 · Chamilo · Chamilo Lms

Elliszat · Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2026-30882

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 1.11.34 and prior

Description Chamilo LMS is a learning management system that has a Reflected Cross-Site Scripting (XSS) issue in the session category listing page. The keyword parameter from the $ REQUEST array is directly included in an HTML href attribute without proper encoding or sanitization. This allows an attacker to inject arbitrary HTML or JavaScript code by breaking out of the attribute context using "> followed by a malicious payload. The issue is triggered when the pagination controls are rendered, which happens when the number of session categories exceeds 20. The vulnerable parameter is keyword.

Recommendations Versions prior to 1.11.36 are affected. Update to version 1.11.36 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-30882

GHSA-QG5F-GQ95-9VHQ

Produtos afetados

Chamilo Lms

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30882.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq · Aviso do Fabricante
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 · Nota
• https://osv.dev/vulnerability/CVE-2026-30882 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2033645280847855811 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755321626140885 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2033771507306905874 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30882 · Nota de Segurança