owen2345 has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 7.6 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- Camaleon CMS 1
- CamaleonCMS 1
- camaleon-cms 1
- camaleon_cms 1
Worst active — by depth score
CVE-2026-56721High· 8.8CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController49CVE-2026-116009High· 8.8Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action48CVE-2026-102261Medium· 5.4A flaw has been found in owen2345 Camaleon CMS up to 2.9.242CVE-2026-86100Medium· 6.4Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature35
owen2345 vulnerabilities
CVEs affecting owen2345, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-116009High· 8.8Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the cr…
CVE-2026-102261Medium· 5.4PoCA flaw has been found in owen2345 Camaleon CMS up to 2.9.2
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_ava…
CVE-2026-86100Medium· 6.4Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal ne…
CVE-2026-56721High· 8.8CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parame…