← Back

CVE-2026-32893

nvd nist
Published: Apr 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: security-advisories@github.com (Secondary)

Description

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $_GET parameters via array_merge() and outputs the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding. This vulnerability is fixed in 2.0.0-RC.3.

Affected (10)

Products: Chamilo: Chamilo Lms
Chamilo
1 product
Chamilo Lms
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Chamilo
Chamilo Lms
Version 2.0.0 alpha1
Chamilo Lms
Version 2.0.0 alpha2
Chamilo Lms
Version 2.0.0 alpha3
Chamilo Lms
Version 2.0.0 alpha4
Chamilo Lms
Version 2.0.0 alpha5
Chamilo Lms
Version 2.0.0 beta1
Chamilo Lms
Version 2.0.0 beta2
Chamilo Lms
Version 2.0.0 beta3
Chamilo Lms
Version 2.0.0 rc1
Chamilo Lms
Version 2.0.0 rc2

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.