SQL Injection Vulnerability in Chamilo Learning Management System
CVE-2026-33714

7.1HIGH

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
14 April 2026

What is CVE-2026-33714?

Chamilo, an open-source learning management system, has a SQL Injection vulnerability present in version 2.0.0-RC.2. This flaw exists within the statistics AJAX endpoint, resulting from an incomplete fix related to previous vulnerabilities. Specifically, the date_start and date_end parameters in the get_user_registration_by_month action were sanitized, whereas they remain unsanitized in the users_active action. This allows authenticated administrators to exploit the vulnerability through time-based blind SQL injection, enabling them to extract arbitrary data from the database. The issue has been addressed and resolved in version 2.0.0.

Affected Version(s)

chamilo-lms >= 2.0.0-RC.2, < 2.0.0

References

https://github.com/chamilo/chamilo-lms/security/advisorie...
x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.