EUVD-2026-57412
GHSA-pp48-wxfh-gjh4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv attacker (PR:L) injects stored script that runs only when a victim loads the form (UI:R); execution in the victim's context crosses a security boundary (S:C) yielding high confidentiality and integrity impact via session/admin-request abuse, no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.
AnalysisAI
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a low-privileged authenticated account on the CamaleonCMS instance (PR:L) and the ability to reach the contact-form edit endpoint, whose missing authorization control is the enabling defect. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.2 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/SC:H/SI:H) is high, but several signals temper the raw number and one inflates it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged authenticated user submits a crafted before_html value containing a script payload to the contact-form edit endpoint, which fails to enforce authorization, storing the payload in the database. When an administrator later opens the page where the contact form renders, the script runs in the admin's browser, exfiltrating session cookies or silently issuing authenticated requests against the admin interface. … |
| Remediation | Patch available per vendor advisory: upgrade CamaleonCMS to the fixed release from the vendor repository at https://github.com/owen2345/camaleon-cms; the exact patched version is not identified in the provided data, so confirm the current fixed tag against the vendor's release notes and the VulnCheck advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin immediately by inventorying all CamaleonCMS deployments using the cama_contact_form plugin; within 24 hours, restrict contact form administration interface access to trusted IP ranges to minimize exposure while preparing for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a m
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote cod
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag,
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read pr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today