Reflected XSS Vulnerability in Chamilo LMS by Chamilo Foundation

CVE-2026-30882

What is CVE-2026-30882?

Chamilo LMS, a widely-used learning management system, is susceptible to a reflected XSS vulnerability found in the session category listing page. This flaw arises from the improper handling of the keyword parameter from $_REQUEST, which is rendered directly into an HTML href attribute without adequate encoding or sanitization. Malicious actors can exploit this vulnerability by injecting arbitrary HTML or JavaScript by escaping the attribute context using the sequence "> followed by a crafted payload. The vulnerability manifests during the rendering of pagination controls when the limits of session categories are exceeded. Notably, this issue has been addressed in version 1.11.36 of Chamilo LMS.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References