CVE-2026-28430

Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php

Critical9.3EPSS 0.35%

Published: 16 Mar 2026
Updated: 17 Mar 2026
Reserved: 27 Feb 2026
Assigned by: GitHub_M

Description

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.

Timeline

2026
27 Feb 2026
27 Feb 2026
ID reserved
By GitHub_M
16 Mar 202617 days later
16 Mar 2026· 17 days later
Published
17 Mar 20261 day later
17 Mar 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-28430, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.35% · top 71% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

chamilo · chamilo-lms
- affected < 1.11.34

References (2)

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-84gw-qjw9-v8jv (opens in a new tab)x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-28430](https://trackcve.app/badge/CVE-2026-28430.svg)](https://trackcve.app/cve/CVE-2026-28430)

Record last updated 17 Mar 2026, 13:38 UTC.