CVE-2026-73331: high-severity vulnerability in owen2345 CamaleonCMS
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
owen2345 · CamaleonCMSRelated CVEs — owen2345 CamaleonCMS
In the same product, most dangerous first.
CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.8%CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73332CRITICALCamaleonCMS cama_contact_form Plugin Stored XSS via before_html FieldEPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-56720MEDIUMCamaleonCMS 2.9.2 and earlier Missing Authorization via profile ActionEPSS 0.3%