CVE Vulnerability Catalog

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the rescanMultiple() method of the backend file controller.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the rescan() function of the backend file controller.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the concrete/controllers/backend/file star() module.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the removeFavoriteFolder($id) function in the backend controller.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the addFavoriteFolder($id) method in the backend controller.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the association reorder module. This vulnerability has been rated 2.3 by the Concrete CMS security team on the CVSS v.4.0 scale.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the event duplication module.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the concrete/controllers/dialog/page/bulk/design module.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the page cache management module. This vulnerability has been rated 2.3 by the Concrete CMS security team on the CVSS v.4.0 scale.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the page bulk delete controller. This vulnerability has been rated 2.3 by the Concrete CMS security team on the CVSS v.4.0 scale.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the log deletion module. This vulnerability has been rated by the Concrete CMS security team as 2.3 on the CVSS v.4.0 scale.

Concrete CMS version 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) in the log deletion module. This vulnerability has been rated by the Concrete CMS security team with a CVSS v.4.0 score of 2.3.

Concrete CMS version 9.5.0 and below emits a CSRF token in the local_available_update.php view, but the do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php does not validate this token. This allows an attacker to perform a cross-site POST attack that can trigger a CMS update to a version specified by the attacker.

Concrete CMS versions 9.5.0 and below do not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker controlling the remote package for a known marketplace item ID can overwrite the PHP package on disk and force its upgrade() method to execute in a single browser navigation.

Concrete CMS versions 9.5.0 and below contain a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker can force the installation of a package without CSRF protection if they can entice an authenticated administrator to visit a crafted page.

Concrete CMS versions 9.5.0 and below do not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php only checks canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller.

Concrete CMS versions 9.5.0 and below are vulnerable to missing authorization in bulk_user_assignment.php, which can lead to privilege escalation to the Administrative Group. Any authenticated user with access to the bulk user assignment dashboard can add any user email to any group and can remove legitimate admins.

Concrete CMS versions 9.5.0 and below are vulnerable to Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller. A rogue administrator can bypass the intended protection mechanism, allowing for the injection of a malicious payload into the database.

Concrete CMS version 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. A rogue administrator with composer form editing rights can exploit this vulnerability to include arbitrary readable files on the server.

LiteLLM prior to version 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. The endpoint restricts updates to the user's own account but does not validate which fields can be changed, enabling a user to escalate their role to proxy_admin.