Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.Referenceshttp://www.securityfocus.com/bid/58735https://exchange.xforce.ibmcloud.com/vulnerabilities/83104
