CVE-2025-2304
Description
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
Is your site exposed to CVE-2025-2304?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2025-2304? +
How do I check if I'm vulnerable to CVE-2025-2304? +
Related Vulnerabilities
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …