CVE-2026-30881 - Vulnerability Analysis

Overview

Chamilo LMS <= 1.11.34 contains a SQL injection caused by improper sanitization of date_start and date_end parameters in the statistics AJAX endpoint, letting authenticated attackers extract data via blind SQL injection.

Severity & Score

Impact

Authenticated attackers can extract sensitive data from the database via blind SQL injection, potentially compromising confidentiality.

Mitigation

Update to version 1.11.36 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5ggx-x2cv-4h44

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-30881 - High (8.8) Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string withou... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30881/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner