Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

Chamilo LMS lets attackers run malicious scripts

CVE-2026-112031 · published today
Summary

The Ticket module in Chamilo LMS versions up to 1.11.40, 2.0.3 and 3.0.1 can be tricked into executing unwanted code when a specially crafted project name is submitted. This could let a remote attacker display false information or steal data from users who view the affected page. Apply the provided software update to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
chamilo lms 1.11.0
Original advisory text
Chamilo LMS Ticket TicketManager.php addProject cross site scripting
A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.0 Low
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published19 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-112031 · NVD
CVE-2026-112031 · MITRE
Track software like this
Free during beta