CVE-2026-30882

Katalog CVE

CVSS 6.1 · Medium EPSS 0,27%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada chamilo lms. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using ">followed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered — which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36.

Rincian

Terbit di NVD

16 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq advisory vendor
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 product · release notes