Owen2345
Monthly
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to extract sensitive data - including administrative credentials and configuration values - from the underlying SQLite database via crafted slug payloads. The flaw exists because the post slug field is incorporated into backend database queries without adequate parameterization, enabling boolean- and union-based blind injection techniques over a standard network-accessible web interface. A vendor patch is available via the upstream GitHub repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-2026-66748 description, CVSS 4.0 vector (base only, no temporal/environmental), CWE-94, tags, POC publicly available, Patch available from vendor, CPE, SSVC, references, release notes with more details. Need to synthesize. Key points from description: Camaleon CMS versions 2.1.1 through 2.9.1, authenticated remote code execution, users with custom_fields manage permission can execute arbitrary Ruby code via select_eval custom field type. They supply a malicious expression in the field options command parameter, evaluated via instance_eval in ERB view when post edit page is rendered, achieving code execution with web process privileges. CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This is a v4 vector. Note the PR:L (low privileges). So authenticated as low privilege? Description says "users with custom_fields manage permission" - that's a specific permission, might be low or high? Typically custom_fields manage is not admin-level, maybe low. PR:L is consistent. AC:L, AV:N, UI:N. Total technical impact. So high CVSS 8.7 (not sure if that's computed score or base? CVSS 4.0 base score with those metrics would be 9.3? Wait, the given score is 8.7, maybe includes some environmental? But vector does not have environmental. Let's compute: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score: impact subscore: VC,H=0.56? Actually CVSS 4.0 formula: base score = max( ( (Impact_subscore * Exploitability_subscore)^? No, need to recall. But not necessary, just given score. We'll assess our own vector (both 3.1 and 4.0) based on description. Key: Authentication required (PR:L). Exploitation requires custom_fields manage permission (PR:L). The vulnerability is in how select_eval custom field type is evaluated. This field type was meant for advanced usage, but now they restrict it with a new permission. So prior to 2
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read profile data belonging to any other user, including administrators. The Admin::UsersController#profile action was explicitly excluded from the validate_role authorization filter with no compensating ownership check, meaning a low-privilege 'client' role account can supply an arbitrary integer user_id query parameter to GET /admin/profile and receive the target user's email, username, role, and custom field data. No public exploit has been identified at time of analysis, but the attack requires only a valid session and a loop over sequential integer IDs.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to extract sensitive data - including administrative credentials and configuration values - from the underlying SQLite database via crafted slug payloads. The flaw exists because the post slug field is incorporated into backend database queries without adequate parameterization, enabling boolean- and union-based blind injection techniques over a standard network-accessible web interface. A vendor patch is available via the upstream GitHub repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-2026-66748 description, CVSS 4.0 vector (base only, no temporal/environmental), CWE-94, tags, POC publicly available, Patch available from vendor, CPE, SSVC, references, release notes with more details. Need to synthesize. Key points from description: Camaleon CMS versions 2.1.1 through 2.9.1, authenticated remote code execution, users with custom_fields manage permission can execute arbitrary Ruby code via select_eval custom field type. They supply a malicious expression in the field options command parameter, evaluated via instance_eval in ERB view when post edit page is rendered, achieving code execution with web process privileges. CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This is a v4 vector. Note the PR:L (low privileges). So authenticated as low privilege? Description says "users with custom_fields manage permission" - that's a specific permission, might be low or high? Typically custom_fields manage is not admin-level, maybe low. PR:L is consistent. AC:L, AV:N, UI:N. Total technical impact. So high CVSS 8.7 (not sure if that's computed score or base? CVSS 4.0 base score with those metrics would be 9.3? Wait, the given score is 8.7, maybe includes some environmental? But vector does not have environmental. Let's compute: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score: impact subscore: VC,H=0.56? Actually CVSS 4.0 formula: base score = max( ( (Impact_subscore * Exploitability_subscore)^? No, need to recall. But not necessary, just given score. We'll assess our own vector (both 3.1 and 4.0) based on description. Key: Authentication required (PR:L). Exploitation requires custom_fields manage permission (PR:L). The vulnerability is in how select_eval custom field type is evaluated. This field type was meant for advanced usage, but now they restrict it with a new permission. So prior to 2
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read profile data belonging to any other user, including administrators. The Admin::UsersController#profile action was explicitly excluded from the validate_role authorization filter with no compensating ownership check, meaning a low-privilege 'client' role account can supply an arbitrary integer user_id query parameter to GET /admin/profile and receive the target user's email, username, role, and custom field data. No public exploit has been identified at time of analysis, but the attack requires only a valid session and a loop over sequential integer IDs.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.