Owen2345 vulnerabilities
We track 11 vulnerabilities in Owen2345 products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Owen2345 vulnerabilities
- 7.1 High severity
Camaleon CMS: Missing Authorization
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private
- 8.8 High severity
camaleon-cms: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to
- 8.7 High severity
CamaleonCMS: Improper Neutralization of Special Elements used in an SQL Command
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edi
- 7.1 High severity
CamaleonCMS: Improper Neutralization of Special Elements used in an SQL Command
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequa
- 8.7 High severity
CamaleonCMS: Improper Neutralization of Input During Web Page Generation
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft crea
- 7.6 High severity
CamaleonCMS: Missing Authorization
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers
- 8.8 High severity
CamaleonCMS: Authorization Bypass Through User-Controlled Key
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw betw
- 8.8 High severity
camaleon-cms: Improper Control of Generation of Code
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom fie
- 9.4 Critical severity
camaleon-cms: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows al
- 7.7 High severity
camaleon-cms: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS
- 9.9 Critical severity
camaleon-cms: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the we