PT-2026-135445
CVE-2026-120429
·
تاريخ النشر
2026-11-02
·
تاريخ التحديث
2026-11-02
الوصف من
CVSS 3.1
7.1
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download private file, and use crop with saved avatar to change other users' avatars.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾