Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-73331CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field

High 7.1

In plain English

A high-severity SQL injection in CamaleonCMS from owen2345. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.

Affected products (as reported)

Vendor	Product	Versions
owen2345	CamaleonCMS	0 – through 2.9.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

Product Repository product, patch
Blog Post product
https://www.vulncheck.com/advisories/camaleoncms-authenticated-sql-injection-via-post-slug-field third-party-advisory