PT-2026-23510

CVE-2025-55208

·

Published

2026-03-05

·

Updated

2026-03-17

Description by

CVSS 3.1
9.0
Critical
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34
Description Chamilo, a learning management system, contains a Stored Cross-Site Scripting (XSS) issue stemming from insecure file uploads within the Social Networks feature. A user with limited privileges can execute arbitrary code within the administrator's inbox, potentially leading to account takeover. The issue is related to file uploads and the Social Networks component. The vulnerable parameter is not specified.
Recommendations Update to version 1.11.34 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-55208
GHSA-2VQ2-826H-6HP6
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com