CVE-2021-34187

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

• CWE-89

• https://github.com/chamilo/chamilo-lms/commit/005dc8e9eccc6ea35264064ae09e2e84af8d5b59Patch, Third Party Advisory
• https://github.com/chamilo/chamilo-lms/commit/f7f93579ed64765c2667910b9c24d031b0a00571Patch, Third Party Advisory
• https://murat.one/?p=118Exploit, Third Party Advisory
• https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injectionPatch, Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/005dc8e9eccc6ea35264064ae09e2e84af8d5b59Patch, Third Party Advisory
• https://github.com/chamilo/chamilo-lms/commit/f7f93579ed64765c2667910b9c24d031b0a00571Patch, Third Party Advisory
• https://murat.one/?p=118Exploit, Third Party Advisory
• https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injectionPatch, Vendor Advisory

Published

Jun 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3418If certificates that signed grub are installed into db, grub…6.4
• CVE-2021-34181Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via …5.4
• CVE-2021-34182An issue in ttyd v.1.6.3 allows attacker to execute arbitrar…9.8
• CVE-2021-34183Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-34184Miniaudio 0.10.35 has a Double free vulnerability that could…9.8
• CVE-2021-34185Miniaudio 0.10.35 has an integer-based buffer overflow cause…7.8
• CVE-2021-3419Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-34190A stored cross site scripting (XSS) vulnerability in index.p…4.8
• CVE-2021-34193Stack overflow vulnerability in OpenSC smart card middleware…7.5
• CVE-2021-3420A flaw was found in newlib in versions prior to 4.0.0. Impro…9.8
• CVE-2021-34201D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow.…7.1
• CVE-2021-34202There are multiple out-of-bounds vulnerabilities in some pro…7.8