What is the CVSS score of CVE-2026-28430?

CVE-2026-28430 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chamilo Lms are affected by CVE-2026-28430?

Chamilo LMS versions before 1.11.34 contain a critical unauthenticated SQL injection vulnerability that allows attackers to extract the entire database including student records, employee data, and…. A patch is available.

How to fix or mitigate CVE-2026-28430?

Within 24 hours: Identify all Chamilo LMS instances and document current versions via administrative dashboards or system inventory. Within 7 days: Upgrade all Chamilo installations to version 1.11.34 or later; if immediate upgrade is not feasible, implement network segmentation to restrict access to Chamilo to trusted internal networks only and disable external API access. Within 30 days: Conduct comprehensive audit of database access logs for the custom_dates parameter, reset all administrative and user passwords, and perform security scan for indicators of database exfiltration or unauthorized account creation.

Chamilo Lms CVE-2026-28430

EUVD-2026-12492 CRITICAL

SQL Injection (CWE-89)

2026-03-16 GitHub_M

SQLi Chamilo Lms

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:50 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.34

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2026-12492

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 19:13 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.

AnalysisAI

Unauthenticated SQL injection in Chamilo LMS versions prior to 1.11.34 enables remote attackers to execute arbitrary database queries through the custom_dates parameter and escalate to full administrative account takeover by exploiting a predictable password reset mechanism. This critical vulnerability exposes the entire database including personally identifiable information and system configurations without requiring any credentials or user interaction. No patch is currently available for affected installations.