CVE-2026-102261Medium· 5.4▾ SunlitA flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_ava…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100897Medium· 5.5A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f
CVE-2026-100885High· 7.3A vulnerability was found in Krayin laravel-crm up to 2.2.4
CVE-2026-100878Medium· 6.3A vulnerability was identified in zhistaredu StarTraining up to 3.8.1
CVE-2026-83805Medium· 6.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-79917Medium· 6.5MaxKB is an open-source AI assistant for enterprise
CVE-2026-85378High· 7.3light0011 cms Chapter Controller ChapterController.class.php _initialize authorization