Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
Chamilo Learning Management System: CSV Data Import XSS
CVE-2025-52468
Summary
A security flaw in Chamilo's CSV import feature allows attackers to inject malicious code into user profiles, which can be triggered when viewed by others. This could lead to unauthorized actions on the system. Update to version 1.11.30 or later to fix the issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| chamilo | chamilo_lms | <= 1.11.30 | – |
Original title
Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitizatio...
Original description
Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30.
nvd CVSS3.1
6.1
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 2 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026