CVE-2023-31806

MediumCVSS 5.4

Published: 09/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the 'My Progress' function. A local attacker can execute arbitrary JavaScript code via a crafted payload.

Risk Assessment

The risk includes session hijacking, data theft, or unauthorized actions performed on behalf of the victim. However, the attack requires prior local access to the system.

Recommendation

Update Chamilo LMS to the latest patched version immediately. Additionally, implement input validation and output encoding for all user-supplied data.

Original NVD description (English source)

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.