CVE-2025-52563

🗓️ 02 Mar 2026 15:50:20Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Chamilo has a reflected cross site scripting flaw via the page parameter in session/add_users_to_session.php; fixed in version 1.11.30.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2025-52563	2 Mar 202615:50	–	attackerkb
CNNVD	Chamilo 安全漏洞	2 Mar 202600:00	–	cnnvd
CNVD	Chamilo add_users_to_session.php file cross-site scripting vulnerability	9 Mar 202600:00	–	cnvd
Cvelist	CVE-2025-52563 Chamilo: Reflected XSS via page parameter	2 Mar 202615:50	–	cvelist
EUVD	EUVD-2025-208178	2 Mar 202615:50	–	euvd
NVD	CVE-2025-52563	2 Mar 202616:16	–	nvd
OSV	CVE-2025-52563 Chamilo: Reflected XSS via page parameter	2 Mar 202615:50	–	osv
Positive Technologies	PT-2026-22620	2 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-52563	4 Mar 202601:57	–	redhatcve
Vulnrichment	CVE-2025-52563 Chamilo: Reflected XSS via page parameter	2 Mar 202615:50	–	vulnrichment

NVD

Vulners

Node

chamilo chamilo_lmsRange<1.11.30

[
  {
    "vendor": "chamilo",
    "product": "chamilo-lms",
    "versions": [
      {
        "version": "< 1.11.30",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/chamilo/chamilo-lms/security/advisories/GHSA-h3m8-53j3-xjx8
github	www.github.com/chamilo/chamilo-lms/releases/tag/v1.11.30

Parameter	Position	Path	Description	CWE
page	query param	session/add_users_to_session.php	Reflected XSS in Chamilo prior to 1.11.30 due to insufficient sanitization of the page parameter in session/add_users_to_session.php	CWE-80, CWE-87, CWE-79

17 Jun 2026 09:36Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.1

CVSS 45.1

EPSS0.00155

SSVC

Chamilo cross site scripting page parameter session endpoint version 1.11.30 vulnerability patch