CVE-2021-26746

Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.

• CWE-79

• https://github.com/chamilo/chamilo-lms/commit/d939402d83bf68af5377b629883d8e5437d843ecPatch, Third Party Advisory
• https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-45-2021-01-21-Moderate-impact-moderate-risk-XSS-vulnerability-in-agendaVendor Advisory
• https://www.netsparker.com/web-applications-advisories/ns-21-001-cross-site-scripting-in-chamilo-lms/Third Party Advisory
• https://github.com/chamilo/chamilo-lms/commit/d939402d83bf68af5377b629883d8e5437d843ecPatch, Third Party Advisory
• https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-45-2021-01-21-Moderate-impact-moderate-risk-XSS-vulnerability-in-agendaVendor Advisory
• https://www.netsparker.com/web-applications-advisories/ns-21-001-cross-site-scripting-in-chamilo-lms/Third Party Advisory

Published

Feb 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26735The Zscaler Client Connector Installer and Unsintallers for …7.8
• CVE-2021-26736Multiple vulnerabilities in the Zscaler Client Connector Ins…7.8
• CVE-2021-26737The Zscaler Client Connector for macOS prior to 3.6 did not …4.7
• CVE-2021-26738Zscaler Client Connector for macOS prior to 3.7 had an unquo…7.8
• CVE-2021-26739SQL Injection vulnerability in pay.php in millken doyocms 2.…9.8
• CVE-2021-26740Arbitrary file upload vulnerability sysupload.php in millken…9.8
• CVE-2021-26747Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Sh…9.8
• CVE-2021-26750DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.…7.8
• CVE-2021-26751NeDi 1.9C allows an authenticated user to perform a SQL Inje…8.8
• CVE-2021-26752NeDi 1.9C allows an authenticated user to execute operating …8.8
• CVE-2021-26753NeDi 1.9C allows an authenticated user to inject PHP code in…9.9
• CVE-2021-26754wpDataTables before 3.4.1 mishandles order direction for ser…9.8