CVE-2025-55289 - Vulnerability Analysis

Overview

Chamilo LMS < 1.11.34 contains a stored XSS caused by improper sanitization in social network and internal messaging features, letting attackers inject JavaScript to execute in authenticated users' browsers, exploit requires victim to be authenticated.

Severity & Score

Impact

Attackers can hijack sessions, perform unauthorized actions, and exfiltrate sensitive data via injected scripts in authenticated users' browsers.

Mitigation

Update to version 1.11.34 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-cchj-3qmf-82j5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🟠 CVE-2025-55289 - High (8.8) Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging f... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55289/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner