CVE Vulnerability Catalog

Concrete CMS version 9.5.0 and below emits a CSRF token in the local_available_update.php view, but the do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php does not validate this token. This allows an attacker to perform a cross-site POST attack that can trigger a CMS update to a version specified by the attacker.

Concrete CMS versions 9.5.0 and below do not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker controlling the remote package for a known marketplace item ID can overwrite the PHP package on disk and force its upgrade() method to execute in a single browser navigation.

Concrete CMS versions 9.5.0 and below contain a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker can force the installation of a package without CSRF protection if they can entice an authenticated administrator to visit a crafted page.

Concrete CMS versions 9.5.0 and below do not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php only checks canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller.

Concrete CMS versions 9.5.0 and below are vulnerable to missing authorization in bulk_user_assignment.php, which can lead to privilege escalation to the Administrative Group. Any authenticated user with access to the bulk user assignment dashboard can add any user email to any group and can remove legitimate admins.

Concrete CMS versions 9.5.0 and below are vulnerable to Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller. A rogue administrator can bypass the intended protection mechanism, allowing for the injection of a malicious payload into the database.

Concrete CMS version 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. A rogue administrator with composer form editing rights can exploit this vulnerability to include arbitrary readable files on the server.

LiteLLM prior to version 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. The endpoint restricts updates to the user's own account but does not validate which fields can be changed, enabling a user to escalate their role to proxy_admin.

A vulnerability in LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes not permitted by their role. The allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions, enabling privilege escalation to proxy_admin.

IINA before version 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.

Authen::TOTP versions before 0.1.1 for Perl generate secrets using the rand function, which is predictable and unsuitable for security usage.

Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database connection credentials in import_mdb.php. These credentials are embedded in source code committed to a public repository, allowing any reader to obtain configuration values that may match deployed installations.

Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database credentials in loader.php, which is publicly accessible. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed installation can read the username, password, and database name.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in db_loader.php where multiple POST parameters are concatenated into mysqli connection arguments. Authenticated attackers can modify queries, allowing them to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php. Values such as latitude, longitude, callsign, mph, altitude, and timestamp are concatenated into UPDATE and INSERT statements without proper sanitization.

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the ORDER BY clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.