CVE-2026-39878: Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated…

PriorityP351critical9.3CVSS 3.1

AVNACLPRNUIRSCCHIHAN

EPSS

0.43%

37.2th percentile

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
chamilo	chamilo-lms	<= 1.11.38	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.