CVE-2025-59543 - Vulnerability Analysis
CriticalCVSS: 9.0Last Updated: March 9, 2026
Chamilo - Stored XSS
Overview
Chamilo < 1.11.34 contains a stored cross-site scripting caused by improper sanitization of the course description field, letting low-privileged attackers execute arbitrary JavaScript in other users' contexts, exploit requires low-privileged account.
Severity & Score
Impact
Attackers can execute arbitrary JavaScript in other users' browsers, leading to session theft and account takeover of higher-privileged users.
Mitigation
Update to version 1.11.34 or later.
References
Social Media Activity(2 posts)
š“ CVE-2025-59543 - Critical (9) Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., tr... š https://www.thehackerwire.com/vulnerability/CVE-2025-59543/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2025-59543 - Critical (9) Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., tr... š https://www.thehackerwire.com/vulnerability/CVE-2025-59543/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2025-59543
- Severity
- Critical
- CVSS Score
- 9.0
- Type
- stored_xss
- Status
- unconfirmed
- EPSS
- 4.1%
- Social Posts
- 2
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H