CVE-2026-28430 - Vulnerability Analysis

Overview

Chamilo LMS < 1.11.34 contains an unauthenticated SQL injection caused by improper sanitization of the custom_dates parameter, letting remote attackers execute arbitrary SQL commands and achieve full administrative takeover, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, access sensitive data, and take over administrative accounts.

Mitigation

Upgrade to version 1.11.34 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-84gw-qjw9-v8jv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🔴 CVE-2026-28430 - Critical (9.8) Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28430/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner