CVE-2019-1000015

Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.

• CWE-79

• https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03Patch, Third Party Advisory
• https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03Patch, Third Party Advisory

Published

Feb 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1000009Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-…
• CVE-2019-1000010phpIPAM version 1.3.2 and earlier contains a Cross Site Scri…
• CVE-2019-1000011API Platform version from 2.2.0 to 2.3.5 contains an Incorre…
• CVE-2019-1000012Hex package manager version 0.14.0 through 0.18.2 contains a…
• CVE-2019-1000013Hex package manager hex_core version 0.3.0 and earlier conta…
• CVE-2019-1000014Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Sig…
• CVE-2019-1000016FFMPEG version 4.1 contains a CWE-129: Improper Validation o…
• CVE-2019-1000017Chamilo Chamilo-lms version 1.11.8 and earlier contains an I…
• CVE-2019-1000018rssh version 2.3.4 contains a CWE-77: Improper Neutralizatio…7.8
• CVE-2019-1000019libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9…6.5
• CVE-2019-1000020libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb…6.5
• CVE-2019-1000021slixmpp version before commit 7cd73b594e8122dddf847953fcfc85…