Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teach…

A stored cross-site scripting (XSS) vulnerability has been discovered in Chamilo learning management system prior to version 1.11.30. The vulnerability exists in the glossary function and allows users with Teacher role privileges to inject malicious JavaScript code that can target administrators. This represents a privilege escalation attack vector where lower-privileged users can potentially compromise administrator accounts. The vulnerability has been addressed in Chamilo version 1.11.30 with multiple commits providing the necessary patches.