Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: camaleon_cms unspecified Clear all filters
TI-2021-07978 CVE-2021-25972 · GHSA-vx6p-q4gj-x6xx

Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature

Priority MEDIUM 56

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs re…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00986 Published 2021-10-20 Fixed in 2.6.0.1 CWE-918
TI-2021-07975 CVE-2021-25969 · GHSA-x78v-4fvj-rg9j

Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments

Priority MEDIUM 60

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00808 Published 2021-10-20 Fixed in 2.6.0.1 CWE-79