PT-2025-52315 · Unknown · Camaleon Cms

Yasin Gergin · Published 2025-12-18 · Updated 2025-12-19 · CVE-2023-53936

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cameleon CMS version 2.7.4

Description The application contains a persistent cross-site scripting issue. Authenticated administrators can inject malicious scripts into post titles. An attacker can create posts with embedded SVG scripts that execute when other users mouse over the post title. This could lead to session cookie theft and arbitrary JavaScript execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-53936

Affected Products

Camaleon Cms

References · 6

• 🔥 https://exploit-db.com/exploits/51446 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53936 · Security Note
• https://github.com/owen2345/camaleon-cms · Note
• https://vulncheck.com/advisories/cameleon-cms-authenticated-persistent-cross-site-scripting-via-post-creation · Note
• https://twitter.com/CVEnew/status/2002117788387663995 · Twitter Post