4.3
MediumCVSS 3.1 · from VulDB
CVE-2026-116282
Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
Kameleo · Information exposure · CWE-200AffectedKameleo
FixNo fix listed yet.
PublishedOct 26, 13:15 · VulDB
ScoredOct 26 · 4.3 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
From VulDB
Affected and fixed versions
ProductAffectedFixed inKameleo5.3.0–Kameleo5.3.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known