CVE-2025-59543 - Vulnerability Analysis

Overview

Chamilo < 1.11.34 contains a stored cross-site scripting caused by improper sanitization of the course description field, letting low-privileged attackers execute arbitrary JavaScript in other users' contexts, exploit requires low-privileged account.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in other users' browsers, leading to session theft and account takeover of higher-privileged users.

Mitigation

Update to version 1.11.34 or later.

References

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p32q-6gh3-3gcv
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner