CVE-2026-33715

CVE-2026-33715 — SSRF non autenticato + Open Email Relay in Chamilo LMS tramite install.ajax.php Gravità : Alta CVSS 7.5 CWE : CWE-918 SSRF + CWE-306 Autenticazione mancante Interessati : chamilo/chamilo-lms 2.0 commit 0195b29 e precedenti Advisory : GHSA-mxc9-9335-45mc NVD :...

EUVD-2026-22710

Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs...