https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T02:38:09.342493+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276340 EUVD-2026-276340 2026-10-18T02:38:09.344207+00:00 EUVD-2026-276340 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28430 fkie_cve-2026-28430 2026-10-18T02:38:09.344237+00:00

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.