CVE-2021-43687

MediumCVSS 6.1

Published: 01/12/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.35%

68th percentile - higher than 68% of all known CVEs

Summary

Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.

Risk Assessment

The risk involves the execution of arbitrary JavaScript code in the victim's browser, potentially leading to session hijacking, account takeover, or sensitive data leakage.

Recommendation

Immediately update Chamilo LMS to the latest available version that includes a fix for this vulnerability. If an update is not possible, temporarily disable or secure access to the /plugin/jcapture/applet.php file.

Original NVD description (English source)

chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.