CVE-2025-52482

Katalog CVE

CVSS 8.3 · High EPSS 0,38%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada chamilo lms. Skor CVSS 3.1 8.3 (High) menurut github.com.

Deskripsi (NVD)

Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4wcp-3rh3-7wm4 exploit · mitigasi · advisory vendor
• https://github.com/chamilo/chamilo-lms/commit/241c569dde0ad0e34d558ae51271f70438189b0e patch
• https://github.com/chamilo/chamilo-lms/commit/82cc07edd8ef316e6b36da7c501120d5c0aeb151 patch
• https://github.com/chamilo/chamilo-lms/commit/f9150075246df4ed9755a4a150e25edb468767be patch
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 product · release notes