CVE-2026-32893
EUVD-2026-2152510.04.2026, 18:16
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $_GET parameters via array_merge() and outputs the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding. This vulnerability is fixed in 2.0.0-RC.3.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| chamilo | chamilo_lms | 2.0.0:alpha1 |
| chamilo | chamilo_lms | 2.0.0:alpha2 |
| chamilo | chamilo_lms | 2.0.0:alpha3 |
| chamilo | chamilo_lms | 2.0.0:alpha4 |
| chamilo | chamilo_lms | 2.0.0:alpha5 |
| chamilo | chamilo_lms | 2.0.0:beta1 |
| chamilo | chamilo_lms | 2.0.0:beta2 |
| chamilo | chamilo_lms | 2.0.0:beta3 |
| chamilo | chamilo_lms | 2.0.0:rc1 |
| chamilo | chamilo_lms | 2.0.0:rc2 |
𝑥
= Vulnerable software versions