CVE-2025-59542

CRITICAL

9.0

Descripcion

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

Detalles CVE

Puntuacion CVSS v3.19.0

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/6/2026

Ultima modificacion3/9/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

chamilo:chamilo_lms

Debilidades (CWE)

CWE-79

Referencias

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34(security-advisories@github.com)

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pxrh-3rcp-h7m6(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.