CVE-2026-82535— Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php
Quick assessment
Affected
chamilo chamilo-lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chamilo LMS 在 1.11.42 之前以及 3.0.0 版本中存在一个存储型跨站脚本（XSS）漏洞。未经身份验证的攻击者可以通过计算确定性的邀请码，并绕过调查提交端点的授权检查，从而在调查答案中注入恶意的脚本负载。攻击者可以提交包含未转义 HTML 的特制答案，这些 HTML 会在报表视图中被渲染，从而在教师或管理员的浏览器会话中执行任意脚本。利用受害者的已认证会话，攻击者可以创建持久的后门账户。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| chamilo | chamilo-lms | 1.11.0≤ 1.11.40 |
affected |
2.0.0≤ 2.0.3 |
affected | ||
1.11.42 |
unaffected | ||
3.0.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82535
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php
Source: CVE Program / CVE List V5
Vulnerability Description
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| chamilo | chamilo-lms | 1.11.0 ~ 1.11.40 | - |
|
II. Public POCs for CVE-2026-82535
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82535
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82535 (2)
Vendor Advisories for CVE-2026-82535 (2)
-
-
🔗 Page not found · GitHub · GitHub vendor-advisory
IV. Related Vulnerabilities
Same product: chamilo-lms
-
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif -
CVE-2026-35196
Chamilo LMS has OS Command Injection via export_all_certific -
CVE-2026-34602
Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthoriz
Same vendor: chamilo
-
CVE-2026-34239
Chamilo Authenticated Remote Code Execution -
CVE-2026-39878
Chamilo stored XSS via user registration leads to admin acco -
CVE-2026-40291
Chamilo LMS has Privilege Escalation via API User Role Modif -
CVE-2026-35196
Chamilo LMS has OS Command Injection via export_all_certific -
CVE-2026-34602
Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthoriz
Same weakness: CWE-79
-
CVE-2026-10148
Booking for Appointments and Events Calendar – Amelia <= 2.4 -
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-90443
软件未认证反射型XSS漏洞 -
CVE-2026-54165
Stored DOM-XSS in public shared-folder image gallery (one-cl -
CVE-2026-81918
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the
V. Comments for CVE-2026-82535
No comments yet