PT-2026-22617 · Chamilo+1 · Chamilo Lms

Published 2026-03-02 · Updated 2026-03-02 · CVE-2025-52470

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description A stored cross-site scripting (XSS) issue exists in the 'session category add.php' script. Improper sanitization of the Category Name field allows privileged users to inject persistent JavaScript payloads. These scripts are executed when accessing 'add many sessions to category.php', which can lead to the compromise of administrative sessions.

Recommendations Update to version 1.11.30.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52470

GHSA-P4M6-GWHG-X89F

Affected Products

Chamilo Lms

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52470.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p4m6-gwhg-x89f · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/ead79db4eb034b8c11a3d6036759d083de37530c · Patch
• https://osv.dev/vulnerability/CVE-2025-52470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52470 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note