PT-2025-39214 · Chamilo · Chamilo

Published 2025-09-23 · Updated 2026-03-11 · CVE-2025-59543

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system susceptible to a stored cross-site scripting (XSS) issue. An attacker with limited access, such as a trainer, can inject malicious JavaScript into the course description field. This allows the execution of arbitrary JavaScript code when other users, including administrators, view the course information page. Successful exploitation can lead to the theft of sensitive session cookies or tokens, potentially resulting in account takeover (ATO) of higher-privileged users. The vulnerable parameter is the course description field.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59543

GHSA-P32Q-6GH3-3GCV

Affected Products

Chamilo

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59543.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p32q-6gh3-3gcv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59543 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59543 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/CveFindCom/status/2029779462758203596 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029873359882965144 · Twitter Post
• https://twitter.com/cyberbivash/status/2029803467489907098 · Twitter Post
• https://twitter.com/cracbot/status/2031686818987696208 · Twitter Post
• https://twitter.com/prakhar0x01/status/1970548516926927099 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031035783952371758 · Twitter Post