CVE-2025-52475: Chamilo: Reflected XSS via keyword_inactive parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/userlist.php endpoint. The keywordinactive parameter is not properly sanitized, allowing attackers to inject malicious JavaScript through a crafted URL. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52475?
CVE-2025-52475 is classified as a medium severity vulnerability due to its potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2025-52475?
To fix CVE-2025-52475, upgrade Chamilo to version 1.11.30 or later, which addresses the reflected XSS vulnerability.
What affects CVE-2025-52475?
CVE-2025-52475 affects Chamilo versions prior to 1.11.30, specifically in the admin/user_list.php endpoint.
What type of vulnerability is CVE-2025-52475?
CVE-2025-52475 is a reflected cross-site scripting (XSS) vulnerability, allowing attackers to inject malicious scripts.
Where is the vulnerable parameter in CVE-2025-52475?
The vulnerable parameter in CVE-2025-52475 is the 'keyword_inactive' parameter, which is not properly sanitized.