CVE Vulnerability Catalog

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. An attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.

In Concrete CMS 9.5.0 and below, missing authorization in bulk_user_assignment.php allows any authenticated user to add any email to any group and remove legitimate admins, leading to privilege escalation.

Concrete CMS version 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller. A rogue administrator with privileges to add blocks can bypass the protection mechanism (_fromCIF === true) by leveraging the REST API, which parses requests using json_decode(), where the string "true" is evaluated as a strict PHP Boolean(true). This allows injection of a malicious serialized payload into the block's filterFields column, which is executed when the block data is viewed or edited, leading to full server takeover.

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can include arbitrary readable files on the server. Combined with extension-only validation (allowing PHP code in .png files), this can lead to authenticated remote code execution.

LiteLLM prior to version 1.83.10 allows a user to modify their own role via the /user/update endpoint. The endpoint restricts access to the user's own account but does not validate which fields can be changed. A user can set their role to proxy_admin, gaining full administrative access to all users, teams, keys, models, and prompt history.

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. The allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions, enabling privilege escalation to proxy_admin.

IINA before version 1.4.3 has a command execution vulnerability via the iina://open custom URL scheme. An attacker can supply a crafted URL with mpv_options/input-commands parameters that, after user approval in the browser, execute arbitrary commands on macOS.

The Authen::TOTP library for Perl before version 0.1.1 generates secrets using the rand function, which is predictable and unsuitable for security purposes.

In Open ISES Tickets before 3.44.2, hardcoded MySQL database credentials (host, username, password, database name) are present in import_mdb.php. These credentials are publicly available in the source repository.

Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements without sanitization. Authenticated attackers can craft requests to read, modify, or destroy database contents.

Open ISES Tickets before 3.44.2 has an SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/mobile_main.php. The GET parameter 'id' is concatenated into the WHERE clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in message.php. POST parameters 'frm_ticket_id' and 'frm_resp_id' are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in db_loader.php. POST parameters 'ticketsdb', 'ticketshost', 'ticketsuser', 'ticketspassword' are concatenated into mysqli connection arguments and dynamic SQL without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 has a SQL injection vulnerability in incs/remotes.inc.php. Values like latitude, longitude, callsign, mph, altitude, and timestamp from external GPS services are concatenated into UPDATE and INSERT statements without sanitization.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in portal/ajax/list_requests.php. GET parameters 'sort' and 'dir' are concatenated into the ORDER BY clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/sit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/fullsit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in tables.php. POST parameters 'tablename', 'indexname', 'sortby' are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.