Vulnerabilities CVE-2026-39878

CVE-2026-39878

Critical

Open

TLP:CLEAR

Chamilo stored XSS via user registration leads to admin account takeover

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

Details

CVSS Score: 9.3
EPSS Score ⓘ: 0.24%

14.7th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Confidence: 90%
Published: Jul 20, 2026
Last Modified: Jul 20, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.