← Back

CVE-2025-66447

nvd nist
Published: Apr 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.7
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.

Affected (11)

Products: Chamilo: Chamilo Lms
Chamilo
1 product
Chamilo Lms
Configuration A
11 vulnerable
Vulnerable SoftwareAffected Versions
Chamilo
Chamilo Lms
Up to 1.11.38
Chamilo Lms
Version 2.0.0 alpha1
Chamilo Lms
Version 2.0.0 alpha2
Chamilo Lms
Version 2.0.0 alpha3
Chamilo Lms
Version 2.0.0 alpha4
Chamilo Lms
Version 2.0.0 alpha5
Chamilo Lms
Version 2.0.0 beta1
Chamilo Lms
Version 2.0.0 beta2
Chamilo Lms
Version 2.0.0 beta3
Chamilo Lms
Version 2.0.0 rc1
Chamilo Lms
Version 2.0.0 rc2

Related CWEs

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.