Cyber Posture

CVE-2025-59543

Critical

Published: 06 March 2026

Published
06 March 2026
Modified
09 March 2026
KEV Added
Patch
CVSS Score 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0005 15.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59543 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validating inputs like course descriptions to prevent injection of malicious JavaScript, directly addressing the insufficient input sanitization causing this stored XSS.

prevent

SI-15 mandates filtering information outputs, such as encoding user-supplied course descriptions before rendering, to block execution of injected scripts in viewers' browsers.

prevent

SI-2 ensures timely flaw remediation, including patching to version 1.11.34, which fixes the specific XSS vulnerability in the course description field.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Stored XSS directly enables arbitrary JavaScript execution in victim browsers (T1059.007) and facilitates session cookie theft or hijacking (T1185/T1539) leading to account takeover.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code…

more

in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

Deeper analysisAI

CVE-2025-59543 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Chamilo, an open-source learning management system (LMS). The flaw exists in versions prior to 1.11.34, specifically within the course description field, where insufficient input sanitization allows the injection of malicious JavaScript code. This issue carries a high CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), reflecting its potential for significant impact across confidentiality, integrity, and availability.

An attacker with a low-privileged account, such as a trainer, can exploit this vulnerability by injecting malicious JavaScript into the course description field. When any other user, including administrators, views the course information page, the script executes in their browser context. This enables the theft of sensitive data like session cookies or authentication tokens, potentially leading to account takeover (ATO) of higher-privileged users.

The vulnerability has been addressed in Chamilo version 1.11.34, as detailed in the official release notes and a corresponding GitHub security advisory (GHSA-p32q-6gh3-3gcv). Security practitioners should prioritize upgrading to the patched version and review existing courses for injected payloads, while implementing content security policies (CSP) to further mitigate XSS risks in Chamilo deployments.

Details

CWE(s)

Affected Products

chamilo
chamilo lms
≤ 1.11.34

CVEs Like This One

CVE-2025-55289Same product: Chamilo Chamilo Lms
CVE-2025-59542Same product: Chamilo Chamilo Lms
CVE-2025-52468Same product: Chamilo Chamilo Lms
CVE-2025-52482Same product: Chamilo Chamilo Lms
CVE-2025-55208Same product: Chamilo Chamilo Lms
CVE-2026-31940Same product: Chamilo Chamilo Lms
CVE-2025-50188Same product: Chamilo Chamilo Lms
CVE-2026-29041Same product: Chamilo Chamilo Lms
CVE-2026-35196Same product: Chamilo Chamilo Lms
CVE-2025-50189Same product: Chamilo Chamilo Lms

References