CVE-2012-4029

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-08 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.

Affected products

Chamilo: before 1.8.8.6 — fixed in 1.8.8.6

How to fix

Upgrade to a fixed version: Chamilo 1.8.8.6. Check the vendor advisory for mitigations.

References

http://support.chamilo.org/attachments/download/2863/chamilo-1.8.8.4-to-1.8.8.6.patch
https://packetstormsecurity.com/files/115927/Chamilo-1.8.8.4-XSS-File-Deletion.html
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-7-2012-07-16-Moderate-risk-Several-moderate-security-flaws
http://support.chamilo.org/attachments/download/2863/chamilo-1.8.8.4-to-1.8.8.6.patch
https://packetstormsecurity.com/files/115927/Chamilo-1.8.8.4-XSS-File-Deletion.html
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-7-2012-07-16-Moderate-risk-Several-moderate-security-flaws

Get alerted when CVE-2012-4029 or the next vulnerability affects your stack