CamaleonCMS vulnerabilities
5 known vulnerabilities in CamaleonCMS from Owen2345. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
CamaleonCMS: Improper Neutralization of Special Elements used in an SQL Command
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edi
- 7.1 High severity
CamaleonCMS: Improper Neutralization of Special Elements used in an SQL Command
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequa
- 8.7 High severity
CamaleonCMS: Improper Neutralization of Input During Web Page Generation
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft crea
- 7.6 High severity
CamaleonCMS: Missing Authorization
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers
- 8.8 High severity
CamaleonCMS: Authorization Bypass Through User-Controlled Key
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw betw