CVE-2026-45146

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-45146

An authenticated administrator can exploit a SQL injection vulnerability in Chamilo LMS prior to versions 1.11.40 and 2.0.1 . The issue exists in the get_sessions action within /main/inc/ajax/model.ajax.php when _search=true is used. Because the groupOp field in the JSON filters parameter is not ...