What is the CVSS score of CVE-2025-59542?

CVE-2025-59542 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2025-59542?

A critical stored cross-site scripting (XSS) vulnerability in Chamilo LMS (CVE-2025-59542) allows attackers to inject malicious scripts that persistently affect all users accessing affected content.

How to fix or mitigate CVE-2025-59542?

Within 24 hours: Identify all Chamilo instances and their versions; notify users of potential exposure and advise against using the system for sensitive activities. Within 7 days: Implement input validation and output encoding controls; deploy WAF rules to detect/block XSS payloads; consider disabling user-generated content features if possible. Within 30 days: Upgrade to Chamilo 1.11.34 or later once patch is available; conduct security audit of stored data for injected scripts; reset user sessions.

Chamilo Lms CVE-2025-59542

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

XSS Chamilo Lms

9.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 04:16 nvd

CRITICAL 9.0

DescriptionNVD

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

AnalysisAI

Stored XSS in Chamilo LMS before 1.11.34.

Technical ContextAI

CWE-79.

RemediationAI

Update.

CVE-2025-59542 vulnerability details – vuln.today

Back

Chamilo Lms CVE-2025-59542

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code