Medium severity · published Feb 4, 2019
CVE-2019-1000015
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php,…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Chamilo Lms · Chamilo
through 1.11.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1000015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1000015
Patch
https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03
More from Chamilo Lms
9.8
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
9.8
CVE-2026-33707
Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms
9.8
CVE-2026-33698
Chamilo LMS affected by unauthenticated RCE in main/install folder
9.8
CVE-2026-28430
Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php
9.8
CVE-2025-52998
Chamilo: PHAR deserialization bypass