CVE-2025-52564CWE-80

Chamilo: HTML injection via open parameter

Medium · published March 2, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-03-02T15:54Z
EPSS history
Timeline
  • 02 MAR 15:54Z
    Chamilo: HTML injection via open parameter
    cvelistv5