Threats Tagged 'ghsa-xf2f-2vj2-6hfr'

Chamilo LMS versions 1.11.0 through 1.11.40 and 2.0.0 through 2.0.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts into survey answers by computing deterministic invitation codes and bypassing authorization checks. The injected scripts execute in the browsers of teachers or administrators viewing survey reports, potentially enabling persistent backdoor account creation via the victim's authenticated session.