romain-deperne/CVE-2026-33715

PoC

Unauthenticated SSRF and open email relay in Chamilo LMS — CVE-2026-33715 / CVSS 7.2

view exploit source poc_in_githubauthor romain-depernepublished 2026-04-29catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-33715US	—OT elevated	0.21% (11th)	Exploit	2026-04-14
Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installe…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.