PT-2025-39213 · Chamilo · Chamilo

Published 2025-09-23 · Updated 2026-03-11 · CVE-2025-59542

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system susceptible to a stored cross-site scripting (XSS) issue. An attacker with a low-privileged account, such as a trainer, can inject malicious JavaScript into the course learning path Settings field. This allows the execution of arbitrary JavaScript code within the context of any user viewing the course information page, potentially including administrators. Successful exploitation can lead to the exfiltration of sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. The vulnerable field is the course learning path Settings field.

Recommendations Upgrade to version 1.11.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59542

GHSA-PXRH-3RCP-H7M6

Affected Products

Chamilo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59542.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pxrh-3rcp-h7m6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59542 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59542 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/cyberbivash/status/2029803474813059382 · Twitter Post
• https://twitter.com/cracbot/status/2031686817184174339 · Twitter Post
• https://twitter.com/prakhar0x01/status/1970548516926927099 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029873310331457597 · Twitter Post
• https://twitter.com/CveFindCom/status/2029779428218118242 · Twitter Post