PT-2026-23632 · Chamilo · Chamilo

Published 2026-03-06 · Updated 2026-03-06 · CVE-2025-59540

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system. A stored cross-site scripting (XSS) issue exists that allows a staff account to execute arbitrary JavaScript in the browser of admin users with higher privileges. The issue occurs because feedback input on the exercise history page is not properly encoded before rendering, enabling malicious scripts to persist in the database and execute when viewed. The vulnerable component is the rendering of feedback input.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-59540

GHSA-59H4-34MX-M67M

Affected Products

Chamilo

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59540.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-59h4-34mx-m67m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59540 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59540 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note