CVE Vulnerability Catalog

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses sanitization. A rogue editor can inject arbitrary JavaScript.

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation, enabling redirect-to-internal bypasses.

In Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler bypasses account status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.

Concrete CMS version 9.5.0 and below is vulnerable to IDOR in the AddMessage and UpdateMessage controllers via the attachments[] parameter. They lack per-file permission checks (canViewFile()), allowing a user who can post in any conversation to reference any file in the CMS file manager by its ID, bypassing the permission system.

Concrete CMS version 9.5.0 and below is vulnerable to unauthorized file deletion due to an inverted CSRF token check in the DeleteFile controller. The CSRF token is rejected when valid and accepted when invalid, enabling CSRF attacks against users with permission to edit conversation messages.

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions.

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Simple Hierarchical Select (SHS) for Drupal 7 versions 7.x-1.0 through 7.x-1.10 contains a cross-site scripting vulnerability due to improper output escaping of term-derived text. Affected paths include shs_field_formatter_view and shs_term_get_children. Malicious taxonomy term names can be rendered unsafely depending on output context.

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A: when the Token module is enabled and token display templates are configured, attacker-controlled token output is rendered without proper sanitization. Vector B: taxonomy term labels are not properly sanitized before rendering, allowing script injection. Affects versions 7.x-1.x up to and including 7.x-1.11.

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block. The action_get_events function does not check canView on the calendar, resulting in restricted event details being disclosed.

Concrete CMS version 9.5.0 and below is vulnerable to authorization bypass in the Calendar Event Frontend Dialog, allowing cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.

Concrete CMS version 9.5.0 and below contains a stored XSS vulnerability in the height parameter. The controller does not validate or sanitize the $height value, allowing users with editor privileges to inject malicious JavaScript executed in visitors' browsers.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.

Concrete CMS version 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method only checks the canInstallPackages() permission before fetching a remote package and writing it to the DIR_PACKAGES directory. An attacker can force an authenticated administrator to download an arbitrary marketplace package.

Concrete CMS version 9.5.0 and below is vulnerable to unauthenticated file usage disclosure due to missing permission checks in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of pages referencing that file, including page IDs, handles, and full URLs, even for restricted pages.

Missing capability check in GSheet For Woo Importer plugin for WordPress (up to 2.3.1) allows authenticated attackers with Subscriber-level access to delete Google Sheets API token and configuration options.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false. An attacker on the network path can present a forged certificate to intercept authentication data.