CVE-2023-31801

MediumCVSS 6.1

Published: 09/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.

Risk Assessment

The risk includes session hijacking, admin account takeover, or malware distribution within the organization through the injected script.

Recommendation

Update Chamilo LMS to the latest version immediately and implement input filtering and validation for the skills wheel parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.