CVE-2026-73329

Name of the Vulnerable Software and Affected Versions CamaleonCMS (affected versions not specified)

Description A stored cross-site scripting issue allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser. This occurs when unsanitized HTML payloads are injected into the post title parameter during draft creation via the drafts creation endpoint. The payload is persisted in the database without escaping and subsequently rendered as raw HTML in the admin drafts listing, which can lead to administrator session compromise, cookie theft, and forged authenticated requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.