Back to Database
Status published
Medium
CVE-2025-52564
Chamilo: HTML injection via open parameter
Vulnerability Description
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52564
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6fmm-qrx4-wgqc
- https://github.com/chamilo/chamilo-lms/commit/083b1d2b0c29b0cc0313a28165ad47bebae9dcb2
- https://github.com/chamilo/chamilo-lms/commit/1ee2d8bb61b67e08946cd80b1a9b92c1a9959c7b
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
More from chamilo
View All →CVE-2025-66447
Chamilo LMS has validation-less redirect on login page
Unknown
0
CVE-2025-59544
Chamilo: Unauthorized access to update category of any user
Medium
6.9
CVE-2025-59543
Chamilo: Account Takeover via Stored XSS in Course Description
Critical
9.1
CVE-2025-59542
Chamilo: Account Takeover via Stored XSS in Course Learning Paths
Critical
9.1
CVE-2025-59541
Chamilo: CSRF Vulnerability in Project Deletion
High
8.1
Affected Vendor
chamilo
View all reports →Affected Software
chamilo-lms
Vulnerable Versions:
< 1.11.30
Timeline
Official Publish:
March 2nd, 2026
Last Modified:
March 2nd, 2026
Added to House:
July 22nd, 2026