5 results · Clear filters · Feed
-
High 7.6
CamaleonCMS Missing Authorization via Plugin Administration Endpoints
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers…
-
High 8.7
CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form ed…
-
High 7.1
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequ…
-
High 8.7
CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft cre…
-
High 8.8
CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw bet…