CVE-2026-33707

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

April 11, 2026

Last Seen

April 11, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Vulnerability CVE-2026-33707 in Chamilo LMS Allows Account Takeover70.5

CVE-2026-33707 is a critical vulnerability affecting Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3. The flaw arises from a weak password reset mechanism that generates predictable tokens using sha1($email) without randomization, expiration, or rate limiting. An unauthenticated attacker can ex...