Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M
CVE-2025-52564Chamilo: HTML injection via open parameter
Medium 6.9
In plain English
A medium-severity security flaw in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chamilo | chamilo-lms | < 1.11.30 |
Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6fmm-qrx4-wgqc x_refsource_CONFIRM
- https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2 x_refsource_MISC
- https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b x_refsource_MISC
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 x_refsource_MISC