CVE-2025-52468 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a stored XSS caused by insufficient sanitization of user data in "Last Name", "First Name", and "Username" fields during CSV import, letting attackers execute scripts in authenticated user context, exploit requires user profile view.

Severity & Score

Impact

Attackers can execute malicious scripts in authenticated users' browsers, potentially stealing data or performing actions on their behalf.

Mitigation

Update to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hc3c-8p55-xh4r
• https://github.com/chamilo/chamilo-lms/commit/790ef513aceacae6fe5b6641145901f04c7992dd
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🟠 CVE-2025-52468 - High (8.8) Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52468/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner