CVE-2025-52564: Chamilo: HTML injection via open parameter
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52564?
CVE-2025-52564 has a moderate severity level due to the potential for HTML injection vulnerabilities.
How do I fix CVE-2025-52564?
To fix CVE-2025-52564, upgrade Chamilo to version 1.11.30 or later, which addresses the HTML injection issue.
What impact does CVE-2025-52564 have on users?
CVE-2025-52564 allows attackers to inject arbitrary HTML, which can compromise the integrity of the web application's content.
Which versions of Chamilo are affected by CVE-2025-52564?
Chamilo versions prior to 1.11.30 are affected by CVE-2025-52564.
Is there a known exploit for CVE-2025-52564?
There are no public exploit details for CVE-2025-52564, but the vulnerability allows for the injection of malicious HTML.