CVE-2026-112031mediumCWE-79CWE-94

CVE-2026-112031: fallo de gravedad media en Chamilo LMS

Chamilo LMS Ticket TicketManager.php addProject cross site scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Chamilo · LMS
CVEs relacionadas — Chamilo LMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-1106MEDIUMChamilo LMS Legal Consent SocialController.php deleteLegal improper authorizationEPSS 0.4%