CVE-2025-52468CWE-79

Chamilo: Stored XSS Vulnerability via CSV User Import

High · published March 2, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-02T15:47Z
EPSS history
Timeline
  • 02 MAR 15:47Z
    Chamilo: Stored XSS Vulnerability via CSV User Import
    cvelistv5