{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-12T01:57:08.139","vulnerabilities":[{"cve":{"id":"CVE-2025-50186","sourceIdentifier":"security-advisories@github.com","published":"2026-03-02T15:16:29.530","lastModified":"2026-03-03T19:12:02.750","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30."},{"lang":"es","value":"Chamilo es un sistema de gestión del aprendizaje. Antes de la versión 1.11.30, existe una vulnerabilidad de secuencias de comandos entre sitios (XSS) almacenada debido a una desinfección insuficiente de los nombres de los archivos CSV. Un atacante puede cargar un archivo CSV con un nombre malicioso (por ejemplo, .csv) que provoca la ejecución de JavaScript cuando lo ven los administradores o usuarios con acceso a los registros de importación o a la visualización de archivos. Este problema se ha solucionado en la versión 1.11.30."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*","versionEndExcluding":"1.11.30","matchCriteriaId":"A3963F8D-F787-4A44-90A3-9F26F9E480AA"}]}]}],"references":[{"url":"https://github.com/chamilo/chamilo-lms/commit/9fef8f30b41d586cb4f4fc823906c16a12ae0ff4","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wrx6-5v5r-mmgx","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}