Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using ">followed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered — which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36.
References
| Link | Resource |
|---|---|
| https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 | Product Release Notes |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq | Vendor Advisory |
Configurations
History
17 Mar 2026, 18:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Chamilo chamilo Lms
Chamilo |
|
| CPE | cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* | |
| References | () https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 - Product, Release Notes | |
| References | () https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq - Vendor Advisory |
16 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-16 20:16
Updated : 2026-03-17 18:52
NVD link : CVE-2026-30882
Mitre link : CVE-2026-30882
CVE.ORG link : CVE-2026-30882
JSON object : View
Products Affected
chamilo
- chamilo_lms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')