CVE-2026-39878

Chamilo LMS vulnerable versions: 1.11.38 and earlier. A stored cross-site scripting flaw in the user registration form allows an unauthenticated attacker to run arbitrary JavaScript in an administrator’s browser session, enabling full platform admin account takeover. The issue is mitigated by upg...