CVE-2025-59542 - Vulnerability Analysis

Overview

Chamilo < 1.11.34 contains a stored cross-site scripting caused by injection of malicious JavaScript in the course learning path Settings field, letting low-privileged attackers execute arbitrary JavaScript in other users' contexts, exploit requires low-privileged account.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in other users' sessions, leading to session hijacking and account takeover.

Mitigation

Update to version 1.11.34 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-pxrh-3rcp-h7m6

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2025-59542 - Critical (9) Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged accoun... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59542/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner