CVE-2023-31804

MediumCVSS 5.4

Published: 09/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.

Risk Assessment

The risk includes session hijacking, administrator account takeover, and potential malware distribution within the e-learning platform.

Recommendation

Immediately update Chamilo LMS to the latest available version and implement input filtering and validation for course category parameters.

Original NVD description (English source)

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.