{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T16:14:28.013","vulnerabilities":[{"cve":{"id":"CVE-2025-59541","sourceIdentifier":"security-advisories@github.com","published":"2026-03-06T04:16:01.977","lastModified":"2026-06-17T09:46:21.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34."},{"lang":"es","value":"Chamilo es un sistema de gestión del aprendizaje. Antes de la versión 1.11.34, una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) permite a un atacante eliminar proyectos dentro de un curso sin el consentimiento de la víctima. El problema surge porque las acciones sensibles, como la eliminación de proyectos, no implementan protecciones anti-CSRF (tokens) y se basan en peticiones GET. Como resultado, un usuario autenticado (Formador) puede ser engañado para ejecutar esta acción no deseada simplemente visitando una página maliciosa. Este problema ha sido parcheado en la versión 1.11.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"chamilo","product":"chamilo-lms","versions":[{"version":"< 1.11.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-06T15:50:43.660217Z","id":"CVE-2025-59541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*","versionEndExcluding":"1.11.34","matchCriteriaId":"BF6714C4-3D58-43BF-A32C-6D436DB93E01"}]}]}],"references":[{"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rpj6-p9m5-q637","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}