CVE-2026-73331: OWEN2345 Camaleoncms

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.

Affected products

• OWEN2345 Camaleoncms: up to and including 2.9.1

Published 2026-08-12. Last modified 2026-09-08.