Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teach…

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Chamilo Learning Management System prior to version 1.11.30. The vulnerability exists in the glossary function and allows users with Teacher role privileges to inject malicious JavaScript code that can be executed against administrators. This represents a privilege escalation attack vector where lower-privileged users can target higher-privileged accounts. The issue has been addressed and patched in version 1.11.30, with multiple GitHub commits providing the security fixes.