CVE-2026-66748General

LOWCVSS 8.7 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

General

1100.0%

Referenced assets1 URL

By indicator

http://exploitgrid.net

Full discourse1 post

ExploitGrid@exploitgrid91d
General
Top #CVEs w/ public exploits (Jul 29): CVE-2026-66748 #Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE CVE-2026-67183 TinyWeb 0.0.8 Memory #Leak DoS via #HTTP Request CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference #DoS Protect via http://exploitgrid.net #Cybersecurity
Post summary
The tweet lists several CVEs known to have public exploits, outlines their vulnerability types, and links to an exploit repository, but provides no detailed technical or mitigation information.
01020203
28 followersView on X

Explore more

Back to dashboard