Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-45144— Chamilo LMS: Stored XSS in public user-profile fields

Quick assessment

Affected
chamilo chamilo-lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Chamilo LMS 是一款开源学习管理系统。在从 2.0.0 到 2.0.1 的版本中， 接口可被匿名访问，并在 模板指令下直接渲染六个可由用户编辑的个人资料字段（ 、 、 、 、 和 ），且写入路径未进行服务器端净化处理。拥有 ROLE_STUDENT 角色的攻击者可在其个人资料中植入恶意 HTML 代码；若系统启用了自动注册功能，原本无权限的攻击者也可获取该角色。当任何访客（包括管理员）访问公开的个人资料链接时，这些存储的恶意内容将在其浏览器中执行，可能导致通过窃取会话令牌、JWT 或 数据而实现账户接管。

CVSS 8.9 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45144

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Chamilo LMS: Stored XSS in public user-profile fields
Source: CVE Program / CVE List V5
Vulnerability Description
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
chamilo chamilo-lms >= 2.0.0, < 2.0.1 -

II. Public POCs for CVE-2026-45144

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-45144

请登录查看更多情报信息。

Vendor Pages for CVE-2026-45144 (1)

Other References for CVE-2026-45144 (2)

Same Patch Batch · chamilo · 2026-10-30 · 4 CVEs total

CVE-2026-45145 7.5 HIGH Chamilo LMS: Database-backed PHP object injection in career deserialization
CVE-2026-44344 6.6 MEDIUM Chamilo LMS: Conditional PHP execution through vendored QuickForm eval
CVE-2026-45141 6.5 MEDIUM Chamilo LMS: CSRF in destructive skill-management AJAX actions

IV. Related Vulnerabilities

Same product: chamilo-lms
Same vendor: chamilo
Same weakness: CWE-79