CVE-2025-52564

MEDIUM EPSS 9.1%
Published Mar 2, 20264mo ago · Modified Mar 3, 20264mo ago
6.9 CVSS 4.0
Medium
Find Similar
Published Mar 2, 2026 4mo ago
Last Modified Mar 3, 2026 4mo ago

Description

Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
9.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-80

Affected Products 1

VendorProductVersionRange
chamilochamilo_lms* <1.11.30

References 4

  • github.com https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2
    Patch
  • github.com https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b
    Patch
  • github.com https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
    ProductRelease Notes
  • github.com https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6fmm-qrx4-wgqc
    Vendor Advisory

Remediation

  • github.com https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2
    Patch
  • github.com https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b
    Patch