What is the CVSS score of CVE-2025-59543?

CVE-2025-59543 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-59543?

Within 24 hours: Inventory all Chamilo deployments and identify instances running versions prior to 1.11.34; disable or restrict access to non-critical Chamilo features if possible. Within 7 days: Implement network segmentation to limit Chamilo access to authorized users only; deploy WAF rules to detect and block XSS payloads; audit logs for signs of exploitation. Within 30 days: Apply vendor patch immediately upon release; conduct full security assessment of Chamilo instance and user accounts for compromise indicators; reset credentials for high-privilege accounts.

Chamilo CVE-2025-59543

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

XSS Chamilo Lms Chamilo

9.0

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.0.
Exploit ScenarioDerived	XSS.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Second stored XSS in Chamilo LMS before 1.11.34.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.0

Second XSS in Chamilo.

RemediationAI

Update.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-79.

Know when Chamilo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionGitHub Advisory

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

Executive ViewAI

Why It Matters

A critical stored cross-site scripting vulnerability in Chamilo LMS (CVE-2025-59543, CVSS 9.0) allows attackers to inject malicious code that persists in the system and executes when users access affected content. This poses an immediate risk to all organizations using Chamilo, potentially compromising user credentials, session data, and enabling lateral attacks against staff and students who access the platform.

Business Impact: Severe

Compensating Controls

Deploy Web Application Firewall (WAF) rules to filter stored XSS payloads in HTTP requests and responses; implement network segmentation to restrict Chamilo access to authorized subnets only; disable user-generated content features (forums, file uploads, comments) if non-essential; enforce Content Security Policy (CSP) headers to limit script execution; require multi-factor authentication for Chamilo administrative accounts; monitor access logs for anomalous activity; consider temporarily disabling Chamilo if exploitation is detected until patch is available.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +45

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*

Related Vulnerabilities in Chamilo LMS Cross-Site Scripting

View all 4

CVE-2025-59542 CRITICAL

9.0

CVE-2025-55289 HIGH

8.8

CVE-2025-59540 MEDIUM

5.4

More in Chamilo

View all

CVE-2023-34960 CRITICAL Emergency POC

9.8 Aug 01

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex

CVE-2025-50187 CRITICAL Act Now POC

9.8 Mar 02

Chamilo LMS prior to 1.11.28 has a code injection through SOAP request parameters enabling remote code execution.

CVE-2025-50192 CRITICAL Act Now POC

9.8 Mar 02

Chamilo LMS prior to 1.11.30 has a time-based SQL injection in a different endpoint, providing an additional database ex

CVE-2025-50190 CRITICAL Act Now POC

9.8 Mar 02

Chamilo LMS prior to 1.11.30 has an error-based SQL injection enabling database extraction.

CVE-2023-3545 CRITICAL Act Now POC

9.8 Nov 28

Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installation

CVE-2023-3533 CRITICAL Act Now POC

9.8 Nov 28

Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20

CVE-2023-3368 CRITICAL Act Now POC

9.8 Nov 28

Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated at

CVE-2021-35414 CRITICAL Act Now POC

9.8 Dec 03

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload

CVE-2021-34187 CRITICAL Act Now POC

9.8 Jun 28

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 p

CVE-2019-13082 CRITICAL Act Now POC

9.8 Jun 30

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. Ra

CVE-2025-50199 CRITICAL Act Now POC

9.1 Mar 02

Chamilo LMS prior to 1.11.30 has a blind SSRF vulnerability enabling internal network reconnaissance from the learning p

CVE-2023-4220 MEDIUM This Month POC

6.1 Nov 28

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in C

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2024-52875 HIGH POC

8.8

References

Advisories & patches

ADVISORY https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p32q-6gh3-3gcv REF https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back