PT-2026-25807 · Chamilo · Chamilo Lms

Elliszat · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-30882

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 1.11.34 and prior

Description Chamilo LMS is a learning management system that has a Reflected Cross-Site Scripting (XSS) issue in the session category listing page. The keyword parameter from the $ REQUEST array is directly included in an HTML href attribute without proper encoding or sanitization. This allows an attacker to inject arbitrary HTML or JavaScript code by breaking out of the attribute context using "> followed by a malicious payload. The issue is triggered when the pagination controls are rendered, which happens when the number of session categories exceeds 20. The vulnerable parameter is keyword.

Recommendations Versions prior to 1.11.36 are affected. Update to version 1.11.36 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30882

GHSA-QG5F-GQ95-9VHQ

Affected Products

Chamilo Lms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30882.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30882 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 · Note
• https://twitter.com/cyberbivash/status/2033645280847855811 · Twitter Post
• https://twitter.com/CVEnew/status/2033755321626140885 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033771507306905874 · Twitter Post