DescriptionChamilo LMS before 1.11.16 contains a stored cross-site scripting vulnerability that allows authenticated users with calendar edit permissions to inject malicious script into agenda entries that are not adequately output-encoded in main/calendar/agenda_list.php. Attackers can craft malicious agenda entries that execute arbitrary JavaScript in the browsers of other users who view the agenda page, leading to session hijacking or further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.