Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2025-52470Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name

Medium 4.8

In plain English

A medium-severity cross-site scripting in chamilo-lms from chamilo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScript payloads. The injected script is later executed when accessing add_many_sessions_to_category.php, potentially compromising administrative sessions. This issue has been patched in version 1.11.30.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.30

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p4m6-gwhg-x89f x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/ead79db4eb034b8c11a3d6036759d083de37530c x_refsource_MISC
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 x_refsource_MISC