CVE-2026-73331: falha de alta gravidade em owen2345 CamaleonCMS
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
owen2345 · CamaleonCMSCVEs relacionadas — owen2345 CamaleonCMS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.8%CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73332CRITICALCamaleonCMS cama_contact_form Plugin Stored XSS via before_html FieldEPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-56720MEDIUMCamaleonCMS 2.9.2 and earlier Missing Authorization via profile ActionEPSS 0.3%