CVE-2026-28430Disclosure(chamilo / chamilo_lms)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.

chamilo CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-84gw-qjw9-v8jv

Other references

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chamilo_lms

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 2 mentions (2026-03-17); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

chamilo

Products

chamilo_lms

Deep dive

Activity timeline4 mentions / 3d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-16	1	Disclosure1
2026-03-17	2	Disclosure2
2026-03-18	1	Disclosure1

Full discourse4 posts

The Hacker Wire@TheHackerWire204d
Disclosure
🔴 CVE-2026-28430 - Critical Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL comma... https://www.thehackerwire.com/vulnerability/CVE-2026-28430/ https://t.co/QNPb3Goo05
Post summary
The tweet announces CVE-2026-28430 as a critical unauthenticated SQL injection in Chamilo LMS, allowing remote execution of arbitrary SQL, but it lacks evidence of active exploitation, a PoC, or patch information.
0000038
138 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds206d
Disclosure
CVE-2026-28430 Unauthenticated SQL Injection in Chamilo LMS Leading to Admin Takeover https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28430
Post summary
CVE-2026-28430 describes a unauthenticated SQL injection in Chamilo LMS that enables an attacker to take over an administrator account.
0000059
4.0K followersView on X
CVE@CVEnew206d
Disclosure
CVE-2026-28430 Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execut… https://www.cve.org/CVERecord?id=CVE-2026-28430
Post summary
A new unauthenticated SQL injection vulnerability has been disclosed in Chamilo LMS versions prior to 1.11.34; the post includes the vulnerability type but does not provide PoC or exploit code.
00000100
56.7K followersView on X
0day Signal@0dayPublishing206d
Disclosure
🚨 CVE-2026-28430: Chamilo LMS Vulnerable to Unauth... Unauthenticated SQLi in `custom_dates` param chains with predictable password reset for instant admin takeover - every ... https://zerodaysignal.com/vulnerability/CVE-2026-28430 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
This post announces a newly discovered unauthenticated SQL injection in Chamilo LMS that can be exploited via the custom_dates parameter to reset passwords and gain immediate admin control.
0000088
151 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chamilo	chamilo_lms	-	-	-

Explore more

Back to dashboard chamilo CVEs chamilo_lms vulnerabilities

What researchers are saying

CVE-2026-28430

The Hacker Wire@TheHackerWireDisclosure

The tweet announces CVE-2026-28430 as a critical unauthenticated SQL injection in Chamilo LMS, allowing remote execution of arbitrary SQL, but it lacks evidence of active exploitation, a PoC, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2026-28430 describes a unauthenticated SQL injection in Chamilo LMS that enables an attacker to take over an administrator account.

CVE@CVEnewDisclosure

A new unauthenticated SQL injection vulnerability has been disclosed in Chamilo LMS versions prior to 1.11.34; the post includes the vulnerability type but does not provide PoC or exploit code.

0day Signal@0dayPublishingDisclosure

This post announces a newly discovered unauthenticated SQL injection in Chamilo LMS that can be exploited via the custom_dates parameter to reset passwords and gain immediate admin control.