CVE-2026-33714

Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0.

• CWE-89

• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-w8c4-c7r8-qgw2Mitigation, Vendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33709JupyterHub is software that allows one to create a multi-use…6.1
• CVE-2026-3371The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-33710Chamilo LMS is a learning management system. Prior to 1.11.3…7.5
• CVE-2026-33711Incus is a system container and virtual machine manager. Inc…7.8
• CVE-2026-33712Typebot is a chatbot builder tool. In versions 3.15.2 and pr…10
• CVE-2026-33713n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33715Chamilo LMS is an open-source learning management system. In…7.2
• CVE-2026-33716WWBN AVideo is an open source video platform. In versions up…9.4
• CVE-2026-33717WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33718OpenHands is software for AI-driven development. Starting in…9.9
• CVE-2026-33719WWBN AVideo is an open source video platform. In versions up…8.6
• CVE-2026-33720n8n is an open source workflow automation platform. Prior to…4.2