CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - Línea 369 root@kitploit: .$thread-getTitle.''; 3. ¡Hay más! Causa Raíz: Los títulos de los hilos del foro se almacenan sin la sanitización adecuada Los títulos de los hilos se muestran sin escape...

CVE-2025-26153

creationtimestamp| type| source ---|---|--- 2025-04-16 22:43:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxo3ko6t52q 2025-04-17 00:25:50+00:00| seen| https://t.me/cvedetector/23176 2025-04-18 12:58:29+00:00| published-proof-of-concept|...

CVE-2025-26153

A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute when victims, such as administrators, reply to the message...