CVE-2026-33715
7.2 · High
Unauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
Domain
Email sending, MIME and SMTP transports.
2 write-ups, 2 vulnerabilities
CVE-2026-34975
8.5 · High
Email header injection in Plunk through raw MIME construction in SESService
Plunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-33715 | Chamilo LMS | Unauthenticated SSRF and mail relay through test_mailer | 7.2 High | |
| CVE-2026-34975 | Plunk | CRLF injection in raw MIME headers | 8.5 High |