CVE-2018-18260 — In the 2.4 version of Camaleon CMS, Stored XSS has been discovered

Back Back to CVE browser

MEDIUM

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered

Published Oct 15, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 1.05%

Description

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."

Affected products

Remediation

No remediation recorded yet.

Metrics

1.05% 0.01049

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01049

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.05% (0.01049)	63.00th	v5 (v2026.06.15)
Sep 20, 2026	1.05% (0.01049)	62.74th	v5 (v2026.06.15)
Jul 20, 2024	0.06% (0.00058)	25.34th	v3 (v2023.03.01)
Jun 3, 2024	0.06% (0.00058)	24.56th	v3 (v2023.03.01)
Mar 7, 2024	0.07% (0.00075)	30.51th	v3 (v2023.03.01)
Sep 3, 2023	0.06% (0.00064)	26.23th	v3 (v2023.03.01)
Mar 7, 2023	0.08% (0.00082)	33.42th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.42% (0.00416)	10.04th	v5 (v2026.06.15)
Apr 14, 2021	0.42% (0.00416)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Link	Providers	Tags
http://packetstormsecurity.com/files/149772/CAMALEON-CMS-2.4-Cross-Site-Scripting.html		Third Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-7f84-9cqf-g4j9		Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2018-18260.yml
https://nvd.nist.gov/vuln/detail/CVE-2018-18260