CVE-2026-73331

Name of the Vulnerable Software and Affected Versions CamaleonCMS version 2.9.1

Description Authenticated attackers with post creation or editing privileges can perform a SQL injection by submitting a crafted slug value. The database backend evaluates this value as part of an inadequately parameterized query, allowing the use of boolean- or union-style blind SQL injection techniques. This can lead to the extraction of sensitive data from the SQLite database, such as administrative credentials and configuration values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.