CVE-2026-82535CWE-79cross-site-scripting

CVE-2026-82535

Medium · published September 11, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-11T22:16Z
References (6)
https://github.com/chamilo/chamilo-lms/commit/be45f2f2a29319afbbf9ce27d094698911799d10 · [email protected]https://github.com/chamilo/chamilo-lms/commit/bea9cbcfc6ca58f387c6c25bef2f15dc5df9d147 · [email protected]https://github.com/chamilo/chamilo-lms/commit/c9d2614d798571b94cef1cb61e605a2fc89f0386 · [email protected]https://github.com/chamilo/chamilo-lms/releases/tag/v3.0.0 · [email protected]https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m3wr-p8wj-jmf6 · [email protected]https://www.vulncheck.com/advisories/chamilo-lms-stored-xss-via-survey-answer-submission-in-reporting-php · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 17:09Z
    Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php
    cvelistv5