Cross-Site Scripting Vulnerability in Chamilo LMS Ticket Module
CVE-2026-112031

5.1MEDIUM

Key Information:

Vendor

Chamilo

Status
Lms
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112031?

A vulnerability exists in the Ticket Module of Chamilo LMS, specifically within the TicketManager::addProject function. This security flaw allows an attacker to manipulate the Name argument, enabling cross-site scripting (XSS) attacks. Exploitation of this vulnerability can occur remotely, posing significant risks to user data and system integrity. A patch has been released to address this issue, and it is strongly recommended that users apply it immediately to safeguard their systems.

Affected Version(s)

LMS 1.11.0

LMS 1.11.1

LMS 1.11.2

References

https://vuldb.com/vuln/421679
vdb-entrytechnical-description
https://vuldb.com/vuln/421679/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112031
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M. Zaeem Shafqat (VulDB User)
.