CVE-2023-53936

5.1 mediumEPSS 0.2%

Medium (5.1) in tuzitio camaleon cms. EPSS 0.2% chance of exploitation in the next 30 days.

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing session cookies and executing arbitrary JavaScript.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tuzitio:camaleon_cms

References

https://github.com/owen2345/camaleon-cms
https://www.exploit-db.com/exploits/51446
https://www.vulncheck.com/advisories/cameleon-cms-authenticated-persistent-cross-site-scripting-via-post-creation

Check your stack JSON