Tuzitio Camaleon_cms
11 CVEs affecting Tuzitio Camaleon_cms. Latest disclosed: 2026-03-10. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46986 | Critical | 9.9 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method… |
CVE-2023-30145 | Critical | 9.8 | 2023-05-26 | Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. |
CVE-2021-25970 | High | 8.8 | 2021-10-20 | Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged… |
CVE-2024-46987 | High | 7.7 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's downlo… |
CVE-2026-1776 | Medium | 6.5 | 2026-03-10 | Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows… |
CVE-2021-25969 | Medium | 6.1 | 2021-10-20 | In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the co… |
CVE-2018-18260 | Medium | 6.1 | 2018-10-15 | In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /… |
CVE-2021-25972 | Medium | 4.9 | 2021-10-20 | In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch… |
CVE-2023-53936 | Medium | 4.8 | 2025-12-18 | Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titl… |
CVE-2024-48652 | Medium | 4.8 | 2024-10-22 | Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. |
CVE-2021-25971 | Medium | 4.3 | 2021-10-20 | In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a lo… |