Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downstream, its output is immediately neutralized by str_replace("\'", "'", ...), which restores any injected single quotes — effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-16 | 3 | Disclosure2Patch1 |
| 2026-03-17 | 2 | Disclosure1General1 |
CVE-2026-30881 SQL Injection in Chamilo LMS 1.11.34 via Unsanitized Statistics Endpoint Parameters https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30881
Post summary
The text discloses a SQL injection vulnerability in Chamilo LMS 1.11.34 that can be triggered via unsanitized statistics endpoint parameters, without mentioning PoC, exploit tool, or active exploitation.
CVE-2026-30881 Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_sta… https://www.cve.org/CVERecord?id=CVE-2026-30881
Post summary
Chamilo LMS ≤1.11.34 is vulnerable to SQL injection via its statistics AJAX endpoint; the report provides technical details but no PoC, exploit code, patch, or evidence of active exploitation.
🟠 CVE-2026-30881 - High Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_RE... https://www.thehackerwire.com/vulnerability/CVE-2026-30881/ https://t.co/UgJQG3y0Mc
Post summary
Chamilo LMS versions 1.11.34 and earlier are vulnerable to a SQL Injection in the statistics AJAX endpoint via the date_start and date_end parameters, as detailed in the cited article.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30881 - Chamilo LMS: SQL Injection in the statistics AJAX endpoint Intel Report: https://ift.tt/G9For8X
Post summary
A new SQL Injection vulnerability (CVE-2026-30881) in Chamilo LMS’s statistics AJAX endpoint is reported.
[CVE-2026-30881: HIGH] Chamilo LMS <1.11.34 SQL Injection vuln in statistics AJAX endpoint allows attackers to inject SQL statements. Patched in v1.11.36. #cybersecurity#cve,CVE-2026-30881,#cybersecurity https://cvefind.com/CVE-2026-30881
Post summary
The post discloses a high‑severity SQL injection flaw in Chamilo LMS versions below 1.11.34, notes that attackers can inject SQL via the statistics AJAX endpoint, and confirms that the issue is fixed in v1.11.36.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chamilo | chamilo_lms | - | - | - |