EUVD-2026-57428
GHSA-mf3v-84v4-vjjc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv user injects the payload (PR:L) but an admin must view the drafts page (UI:R); execution in the admin context crosses a trust boundary (S:C) yielding high confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the database without escaping and later rendered as raw HTML in the admin drafts listing, enabling administrator session compromise, cookie theft, and forged authenticated requests.
AnalysisAI
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with at least low privileges (PR:L) able to reach the drafts creation endpoint and submit a post title, plus the specific product feature of unsanitized draft-title storage and the admin drafts listing view being the rendering sink. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.2 (Critical) reflects network attack vector (AV:N), low complexity (AC:L), only low privileges required (PR:L), and a scope/subsequent-system impact (SC:H/SI:H) representing the pivot into the admin's context - but it is tempered by UI:A, meaning an administrator must actually view the drafts page for the payload to fire. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged authenticated user (e.g., a contributor account) submits a draft whose title contains a script payload such as an image tag with an onerror handler through the drafts creation endpoint. The payload is stored unescaped and executes automatically the next time an administrator opens the admin drafts listing, exfiltrating the admin's session cookie or issuing forged administrative actions. … |
| Remediation | Patch available per vendor advisory - upgrade CamaleonCMS to the fixed release from the vendor repository at https://github.com/owen2345/camaleon-cms; the input data confirms a patch is available but does not specify an exact fixed version, so verify the patched tag/release against the vendor changelog and the VulnCheck advisory (https://www.vulncheck.com/advisories/camaleoncms-stored-xss-via-draft-post-title-creation-endpoint) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users with low-privilege account access to CamaleonCMS and restrict draft editing permissions if administratively feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist a
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote cod
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag,
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read pr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today