FKIE_CVE-2026-30882

Vulnerability from fkie_nvd - Published: 2026-03-16 20:16 - Updated: 2026-03-17 18:52
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using ">followed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered — which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36.
References
security-advisories@github.comhttps://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36Product, Release Notes
security-advisories@github.comhttps://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhqVendor Advisory
Impacted products
Vendor Product Version
chamilo chamilo_lms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87C4F8D8-CDE4-42B6-8661-0F7823DC1079",
              "versionEndExcluding": "1.11.36",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using \"\u003efollowed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered \u2014 which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36."
    },
    {
      "lang": "es",
      "value": "Chamilo LMS es un sistema de gesti\u00f3n del aprendizaje. Chamilo LMS versi\u00f3n 1.11.34 y anteriores contiene una vulnerabilidad de cross-site scripting (XSS) reflejado en la p\u00e1gina de listado de categor\u00edas de sesi\u00f3n. El par\u00e1metro keyword de $_REQUEST se reproduce directamente en un atributo HTML href sin ninguna codificaci\u00f3n o sanitizaci\u00f3n. Un atacante puede inyectar HTML/JavaScript arbitrario saliendo del contexto del atributo usando \"\u0026gt;seguido de una carga \u00fatil maliciosa. La vulnerabilidad se activa cuando se renderizan los controles de paginaci\u00f3n \u2014 lo que ocurre cuando el n\u00famero de categor\u00edas de sesi\u00f3n excede de 20 (el l\u00edmite de la p\u00e1gina). Este problema ha sido parcheado en la versi\u00f3n 1.11.36."
    }
  ],
  "id": "CVE-2026-30882",
  "lastModified": "2026-03-17T18:52:21.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-16T20:16:18.790",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qg5f-gq95-9vhq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.