Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.

By admin