CVE-2025-55289

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-55289
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55289.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-55289
Aliases
  • GHSA-cchj-3qmf-82j5
Published
2026-03-06T03:27:45.731Z
Modified
2026-04-10T05:29:54.452089Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Chamilo: Stored Cross Site Scripting in Skills Argumentation
Details

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their browser within the LMS context. This enables full account takeover via session hijacking, unauthorized actions with the victim’s privileges, exfiltration of sensitive data, and potential self-propagation to other users. This issue has been patched in version 1.11.34.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55289.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/chamilo/chamilo-lms

Affected ranges

Type
GIT
Repo
https://github.com/chamilo/chamilo-lms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7eb5c84dbd65b950c1ccfbc6b0262d60b04e40b7

Affected versions

Other
CHAMILO_1_8_7_ALPHA_1
CHAMILO_1_8_7_ALPHA_2
CHAMILO_1_8_7_RC2
CHAMILO_1_8_7_RC_1
CHAMILO_1_8_7_STABLE
CHAMILO_1_8_7_STABLE_BIS
CHAMILO_1_8_8_2_RC_1
CHAMILO_1_8_8_2_STABLE
CHAMILO_1_8_8_2_STABLE_2
CHAMILO_1_8_8_4_STABLE
CHAMILO_1_8_8_ALPHA
CHAMILO_1_8_8_BETA_1
CHAMILO_1_8_8_BETA_2
CHAMILO_1_9_0_ALPHA_1
CHAMILO_1_9_0_ALPHA_2
CHAMILO_1_9_0_ALPHA_4
CHAMILO_1_9_0_PRE_ALPHA
CHAMILO_1_9_0_RC_1
CHAMILO_1_9_0_STABLE_2
CHAMILO_1_9_0_STABLE_3
CHAMILO_1_9_2_STABLE
CHAMILO_1_9_2_STABLE_QUARTER
CHAMILO_1_9_4_ALPHA_1
CHAMILO_1_9_4_RC_1
CHAMILO_1_9_4_STABLE
CHAMILO_1_9_6_RC_1
CHAMILO_1_9_6_RC_2
CHAMILO_1_9_6_STABLE
CHAMILO_1_8_8.*
CHAMILO_1_8_8.3_STABLE_4
v1.*
v1.11.10
v1.11.12
v1.11.14
v1.11.14-beta.1
v1.11.18
v1.11.20
v1.11.20-beta.1
v1.11.22
v1.11.22-beta.1
v1.11.22-beta.2
v1.11.24
v1.11.26
v1.11.26-rc.1
v1.11.28
v1.11.30
v1.11.30-rc.1
v1.11.32
v1.11.6
v1.11.6-alpha.1
v1.8.6.1
v1.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55289.json"